From 2588d19d9a2f9eed04f496854dee8cd8f2faf0c7 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 28 May 2019 15:50:14 -0700 Subject: [PATCH 0001/1037] Added dev comments --- windows/client-management/mdm/bitlocker-csp.md | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md index 917fb0bafa..bfb6938f87 100644 --- a/windows/client-management/mdm/bitlocker-csp.md +++ b/windows/client-management/mdm/bitlocker-csp.md @@ -110,7 +110,21 @@ The following diagram shows the BitLocker configuration service provider in tree -

Data type is integer. Sample value for this node to enable this policy: 1. Disabling this policy will not turn off the encryption on the system card, but the user will no longer be prompted to turn it on.

+

Data type is integer. Sample value for this node to enable this policy: 1.

+

Supported operations are Add, Get, Replace, and Delete.

+

RequireDeviceEncryption must be set to 1 to check the device's enforcement status. If the value is not set or is set to 0, the device's enforcement status will not be checked.

+ +

An OS volume's protection status is checked with a Get operation. Typically, BitLocker/Device Encryption will follow whichever value EncryptionMethodByDriveType policy is set to. However, if the OS drive is a self-encrypting drive, this policy setting will be ignored.

+ +

Encryptable fixed data volumes are treated similarly to OS volumes. However, fixed data volumes must meet additional criteria to be considered encryptable:

+ +* The fixed data volume must have supported firmware (BIOS or UEFI). +* It must not be a dynamic volume. +* It must not be a recovery partition. +* It must not be a hidden volume. +* It must not be a system partition. +* It must not be backed by virtual storage. +* It must not have a reference in the BCD store.

If you want to disable this policy use the following SyncML:

@@ -133,8 +147,6 @@ The following diagram shows the BitLocker configuration service provider in tree ``` -

Data type is integer. Supported operations are Add, Get, Replace, and Delete.

- **EncryptionMethodByDriveType**

Allows you to set the default encrytion method for each of the different drive types: operating system drives, fixed data drives, and removable data drives. Hidden, system and recovery partitions are skipped from encryption. This setting is a direct mapping to the Bitlocker Group Policy "Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later)".

From ca108dfa6c134b595b382b0c656f6a218c171205 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Wed, 29 May 2019 09:57:59 -0700 Subject: [PATCH 0002/1037] minor update --- windows/client-management/mdm/bitlocker-csp.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md index bfb6938f87..18406fe831 100644 --- a/windows/client-management/mdm/bitlocker-csp.md +++ b/windows/client-management/mdm/bitlocker-csp.md @@ -112,7 +112,6 @@ The following diagram shows the BitLocker configuration service provider in tree

Data type is integer. Sample value for this node to enable this policy: 1.

Supported operations are Add, Get, Replace, and Delete.

-

RequireDeviceEncryption must be set to 1 to check the device's enforcement status. If the value is not set or is set to 0, the device's enforcement status will not be checked.

An OS volume's protection status is checked with a Get operation. Typically, BitLocker/Device Encryption will follow whichever value EncryptionMethodByDriveType policy is set to. However, if the OS drive is a self-encrypting drive, this policy setting will be ignored.

@@ -126,6 +125,11 @@ The following diagram shows the BitLocker configuration service provider in tree * It must not be backed by virtual storage. * It must not have a reference in the BCD store. +

The following list shows the supported values:

+ +- 0 – Disable. If the policy setting is not set or is set to 0, the device's enforcement status will not be checked, but the device encryption will still be on. +- 1 (default) – Enable. The device's enforcement status will be checked. +

If you want to disable this policy use the following SyncML:

``` syntax From 54f68f3cd70d3ade60cbc338d83dda05665f94b1 Mon Sep 17 00:00:00 2001 From: Christopher Yoo Date: Fri, 7 Jun 2019 16:39:45 -0700 Subject: [PATCH 0003/1037] Call out for those without Store on their machine --- windows/privacy/diagnostic-data-viewer-overview.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/privacy/diagnostic-data-viewer-overview.md b/windows/privacy/diagnostic-data-viewer-overview.md index ec0ba4cd4a..92b7cb467a 100644 --- a/windows/privacy/diagnostic-data-viewer-overview.md +++ b/windows/privacy/diagnostic-data-viewer-overview.md @@ -44,6 +44,9 @@ Before you can use this tool for viewing Windows diagnostic data, you must turn ### Download the Diagnostic Data Viewer Download the app from the [Microsoft Store Diagnostic Data Viewer](https://www.microsoft.com/en-us/store/p/diagnostic-data-viewer/9n8wtrrsq8f7?rtc=1) page. + >[!Important] + >It's possible that your Windows machine may not have the Microsoft Store available (e.g. Windows Server). If this is the case, please check out [Diagnostic Data Viewer for PowerShell](https://go.microsoft.com/fwlink/?linkid=2023830). + ### Start the Diagnostic Data Viewer You can start this app from the **Settings** panel. From 571ede347299e39f7d762b0972120a1482b33e39 Mon Sep 17 00:00:00 2001 From: mapalko Date: Mon, 10 Jun 2019 11:59:23 -0700 Subject: [PATCH 0004/1037] Updating CDF references Removing some of the CDF section. This should not be recommended to meet FIPS compliance. --- .../threat-protection/windows-10-mobile-security-guide.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/windows/security/threat-protection/windows-10-mobile-security-guide.md b/windows/security/threat-protection/windows-10-mobile-security-guide.md index cadf290d91..cd1f4442c5 100644 --- a/windows/security/threat-protection/windows-10-mobile-security-guide.md +++ b/windows/security/threat-protection/windows-10-mobile-security-guide.md @@ -72,8 +72,6 @@ The biometric image collected at enrollment is converted into an algorithmic for A Windows Hello companion device enables a physical device, like a wearable, to serve as a factor for validating the user’s identity before granting them access to their credentials. For instance, when the user has physical possession of a companion device they can easily, possibly even automatically, unlock their PC and authenticate with apps and websites. This type of device can be useful for smartphones or tablets that don’t have integrated biometric sensors or for industries where users need a faster, more convenient sign-in experience, such as retail. -In some cases, the companion device for Windows Hello enables a physical device, like a phone, wearable, or other types of device to store all of the user’s credentials. Storage of the credentials on a mobile device makes it possible to use them on any supporting device, like a kiosk or family PC, and eliminates the need to enroll Windows Hello on each device. Companion devices also help enable organizations to meet regulatory requirements, such as Federal Information Processing Standard (FIPS) Publication 140-2, (FIPS 140-2). - ### Standards-based approach The Fast Identity Online (FIDO) Alliance is a nonprofit organization that works to address the lack of interoperability among strong authentication devices and the problems users face in creating and remembering multiple user names and passwords. FIDO standards help reduce reliance on passwords to authenticate users of online services securely, allowing any business network, app, website, or cloud application to interface with a broad variety of existing and future FIDO-enabled devices and operating system platforms. From 97758f49989d22ddb32f17778cddd58b24b01394 Mon Sep 17 00:00:00 2001 From: Liza Poggemeyer Date: Wed, 12 Jun 2019 15:20:26 -0700 Subject: [PATCH 0005/1037] Changed "machine" to "device." --- windows/privacy/diagnostic-data-viewer-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/diagnostic-data-viewer-overview.md b/windows/privacy/diagnostic-data-viewer-overview.md index 92b7cb467a..44a4dba799 100644 --- a/windows/privacy/diagnostic-data-viewer-overview.md +++ b/windows/privacy/diagnostic-data-viewer-overview.md @@ -45,7 +45,7 @@ Before you can use this tool for viewing Windows diagnostic data, you must turn Download the app from the [Microsoft Store Diagnostic Data Viewer](https://www.microsoft.com/en-us/store/p/diagnostic-data-viewer/9n8wtrrsq8f7?rtc=1) page. >[!Important] - >It's possible that your Windows machine may not have the Microsoft Store available (e.g. Windows Server). If this is the case, please check out [Diagnostic Data Viewer for PowerShell](https://go.microsoft.com/fwlink/?linkid=2023830). + >It's possible that your Windows device doesn't have the Microsoft Store available (e.g. Windows Server). If this is the case, please check out [Diagnostic Data Viewer for PowerShell](https://go.microsoft.com/fwlink/?linkid=2023830). ### Start the Diagnostic Data Viewer You can start this app from the **Settings** panel. From fd0654a2fc5932f30eb1ed084295ef93f66b5b83 Mon Sep 17 00:00:00 2001 From: Marcelo di Iorio Date: Thu, 13 Jun 2019 10:22:37 +0200 Subject: [PATCH 0006/1037] Update hello-hybrid-cert-whfb-settings-pki.md In line 114, shouldn't we say "Exchange Enrollment Agent (Offline request)"? --- .../hello-for-business/hello-hybrid-cert-whfb-settings-pki.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md index 6e3126b3c7..d4233e1945 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md @@ -111,7 +111,7 @@ Sign-in a certificate authority or management workstations with *Domain Admin* e 1. Open the **Certificate Authority** management console. 2. Right-click **Certificate Templates** and click **Manage**. -3. In the **Certificate Template** console, right-click the **Exchange Enrollment Agent** template in the details pane and click **Duplicate Template**. +3. In the **Certificate Template** console, right-click the **Exchange Enrollment Agent (Offline request)** template in the details pane and click **Duplicate Template**. 4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Authority** list. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Recipient** list. 5. On the **General** tab, type **WHFB Enrollment Agent** in **Template display name**. Adjust the validity and renewal period to meet your enterprise's needs. 6. On the **Subject** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **Fully distinguished name** from the **Subject name format** list if **Fully distinguished name** is not already selected. Select the **User Principal Name (UPN)** check box under **Include this information in alternative subject name**. From b4e06f0a5db03e0f2067a1e1cb37a305f370b705 Mon Sep 17 00:00:00 2001 From: Chris Kibble <39386226+ChrisKibble@users.noreply.github.com> Date: Thu, 13 Jun 2019 08:40:54 -0400 Subject: [PATCH 0007/1037] Fixed end comment in previous suggested file change. --- windows/deployment/update/feature-update-user-install.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/deployment/update/feature-update-user-install.md b/windows/deployment/update/feature-update-user-install.md index 489c2fcbfd..f46f295f30 100644 --- a/windows/deployment/update/feature-update-user-install.md +++ b/windows/deployment/update/feature-update-user-install.md @@ -69,6 +69,7 @@ foreach ($k in $iniSetupConfigKeyValuePair.Keys) #Write content to file New-Item $iniFilePath -ItemType File -Value $iniSetupConfigContent -Force +<# Disclaimer Sample scripts are not supported under any Microsoft standard support program or service. The sample scripts is provided AS IS without warranty of any kind. Microsoft further disclaims all implied warranties including, without @@ -78,6 +79,7 @@ Microsoft, its authors, or anyone else involved in the creation, production, or for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss) arising out of the use of or inability to use the sample script or documentation, even if Microsoft has been advised of the possibility of such damages. +#> ``` >[!NOTE] From f6c4d1db54f2a407b3647276640910d0ba6fbe65 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Fri, 14 Jun 2019 13:21:47 -0700 Subject: [PATCH 0008/1037] Added dev comments --- .../client-management/mdm/bitlocker-csp.md | 221 +++++++++--------- 1 file changed, 111 insertions(+), 110 deletions(-) diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md index 12c1053dcf..2dd4667545 100644 --- a/windows/client-management/mdm/bitlocker-csp.md +++ b/windows/client-management/mdm/bitlocker-csp.md @@ -31,10 +31,10 @@ The following diagram shows the BitLocker configuration service provider in tree ![bitlocker csp](images/provisioning-csp-bitlocker.png) **./Device/Vendor/MSFT/BitLocker** -

Defines the root node for the BitLocker configuration service provider.

+Defines the root node for the BitLocker configuration service provider. **RequireStorageCardEncryption** -

Allows the administrator to require storage card encryption on the device. This policy is valid only for a mobile SKU.

+Allows the administrator to require storage card encryption on the device. This policy is valid only for a mobile SKU.
@@ -57,14 +57,14 @@ The following diagram shows the BitLocker configuration service provider in tree
-

Data type is integer. Sample value for this node to enable this policy: 1. Disabling this policy will not turn off the encryption on the storage card, but the user will no longer be prompted to turn it on.

+Data type is integer. Sample value for this node to enable this policy: 1. Disabling this policy will not turn off the encryption on the storage card, but the user will no longer be prompted to turn it on. - 0 (default) – Storage cards do not need to be encrypted. - 1 – Require Storage cards to be encrypted. -

Disabling this policy will not turn off the encryption on the system card, but the user will no longer be prompted to turn it on.

+Disabling this policy will not turn off the encryption on the system card, but the user will no longer be prompted to turn it on. -

If you want to disable this policy use the following SyncML:

+If you want to disable this policy use the following SyncML: ``` syntax @@ -85,11 +85,11 @@ The following diagram shows the BitLocker configuration service provider in tree ``` -

Data type is integer. Supported operations are Add, Get, Replace, and Delete.

+Data type is integer. Supported operations are Add, Get, Replace, and Delete. **RequireDeviceEncryption** -

Allows the administrator to require encryption to be turned on by using BitLocker\Device Encryption.

+Allows the administrator to require encryption to be turned on by using BitLocker\Device Encryption. @@ -112,12 +112,12 @@ The following diagram shows the BitLocker configuration service provider in tree
-

Data type is integer. Sample value for this node to enable this policy: 1.

-

Supported operations are Add, Get, Replace, and Delete.

+Data type is integer. Sample value for this node to enable this policy: 1. +Supported operations are Add, Get, Replace, and Delete. -

An OS volume's protection status is checked with a Get operation. Typically, BitLocker/Device Encryption will follow whichever value EncryptionMethodByDriveType policy is set to. However, if the OS drive is a self-encrypting drive, this policy setting will be ignored.

+Status of OS volumes and encryptable fixed data volumes are checked with a Get operation. Typically, BitLocker/Device Encryption will follow whichever value [EncryptionMethodByDriveType](#encryptionmethodbydrivetype) policy is set to. However, this policy setting will be ignored for self-encrypting fixed drives and self-encrypting OS drives. -

Encryptable fixed data volumes are treated similarly to OS volumes. However, fixed data volumes must meet additional criteria to be considered encryptable:

+Encryptable fixed data volumes are treated similarly to OS volumes. However, fixed data volumes must meet additional criteria to be considered encryptable: * The fixed data volume must have supported firmware (BIOS or UEFI). * It must not be a dynamic volume. @@ -127,12 +127,12 @@ The following diagram shows the BitLocker configuration service provider in tree * It must not be backed by virtual storage. * It must not have a reference in the BCD store. -

The following list shows the supported values:

+The following list shows the supported values: - 0 – Disable. If the policy setting is not set or is set to 0, the device's enforcement status will not be checked, but the device encryption will still be on. -- 1 (default) – Enable. The device's enforcement status will be checked. +- 1 (default) – Enable. The device's enforcement status will be checked. Setting this policy to 1 will trigger encryption of all drives (silently or non-silently based on [AllowWarningForOtherDiskEncryption](#allowwarningforotherdiskencryption) policy). -

If you want to disable this policy use the following SyncML:

+If you want to disable this policy use the following SyncML: ``` syntax @@ -153,8 +153,9 @@ The following diagram shows the BitLocker configuration service provider in tree ``` -**EncryptionMethodByDriveType** -

Allows you to set the default encrytion method for each of the different drive types: operating system drives, fixed data drives, and removable data drives. Hidden, system and recovery partitions are skipped from encryption. This setting is a direct mapping to the Bitlocker Group Policy "Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later)".

+**EncryptionMethodByDriveType** + +Allows you to set the default encrytion method for each of the different drive types: operating system drives, fixed data drives, and removable data drives. Hidden, system and recovery partitions are skipped from encryption. This setting is a direct mapping to the Bitlocker Group Policy "Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later)". @@ -175,7 +176,7 @@ The following diagram shows the BitLocker configuration service provider in tree
Homecross mark
-

ADMX Info:

+ADMX Info: