mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-15 18:33:43 +00:00
Merge remote-tracking branch 'refs/remotes/origin/rs1' into jdprov
This commit is contained in:
jdeckerMS
@ -19,7 +19,7 @@
|
||||
### [Manage Microsoft Surface Hub](manage-surface-hub.md)
|
||||
#### [Accessibility](accessibility-surface-hub.md)
|
||||
#### [Change the Surface Hub device account](change-surface-hub-device-account.md)
|
||||
#### [Device reset](device-reset-suface-hub.md)
|
||||
#### [Device reset](device-reset-surface-hub.md)
|
||||
#### [End a Surface Hub meeting with I'm Done](i-am-done-finishing-your-surface-hub-meeting.md)
|
||||
#### [Install apps on your Surface Hub](install-apps-on-surface-hub.md)
|
||||
#### [Manage settings with a local admin account](manage-settings-with-local-admin-account-surface-hub.md)
|
||||
|
||||
@ -2,6 +2,7 @@
|
||||
title: Device reset (Surface Hub)
|
||||
description: You may wish to reset your Microsoft Surface Hub.
|
||||
ms.assetid: 44E82EEE-1905-464B-A758-C2A1463909FF
|
||||
redirect_url: https://technet.microsoft.com/en-us/itpro/surface-hub/device-reset-surface-hub
|
||||
keywords: reset Surface Hub
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
@ -27,7 +28,10 @@ Initiating a reset will return the device to the last cumulative Windows update,
|
||||
- MDM enrollment
|
||||
- Domain join or Azure AD join information
|
||||
- Local admins on the device
|
||||
- Configurations from MDM or the Settings app.
|
||||
- Configurations from MDM or the Settings app
|
||||
|
||||
**Important Note**</br>
|
||||
Performing a device reset may take up to 6 hours. Do not interrupt the reset process. Interrupting the process will render the device inoperable, requiring warranty service to return to normal functionality.
|
||||
|
||||
After the reset, you'll be taken through the [first run program](first-run-program-surface-hub.md) again.
|
||||
|
||||
|
||||
42
devices/surface-hub/device-reset-surface-hub.md
Normal file
42
devices/surface-hub/device-reset-surface-hub.md
Normal file
@ -0,0 +1,42 @@
|
||||
---
|
||||
title: Device reset (Surface Hub)
|
||||
description: You may wish to reset your Microsoft Surface Hub.
|
||||
ms.assetid: 44E82EEE-1905-464B-A758-C2A1463909FF
|
||||
keywords: reset Surface Hub
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
ms.pagetype: surfacehub
|
||||
author: TrudyHa
|
||||
---
|
||||
|
||||
# Device reset (Surface Hub)
|
||||
|
||||
|
||||
You may wish to reset your Microsoft Surface Hub.
|
||||
|
||||
Typical reasons for a reset include:
|
||||
|
||||
- The device isn’t running well after installing an update.
|
||||
- You’re repurposing the device for a new meeting space and want to reconfigure it.
|
||||
- You want to change how you locally manage the device.
|
||||
|
||||
Initiating a reset will return the device to the last cumulative Windows update, and remove all local user files and configuration, including:
|
||||
|
||||
- The device account
|
||||
- MDM enrollment
|
||||
- Domain join or Azure AD join information
|
||||
- Local admins on the device
|
||||
- Configurations from MDM or the Settings app
|
||||
|
||||
**Important Note**</br>
|
||||
Performing a device reset may take up to 6 hours. Do not interrupt the reset process. Interrupting the process will render the device inoperable, requiring warranty service to return to normal functionality.
|
||||
|
||||
After the reset, you'll be taken through the [first run program](first-run-program-surface-hub.md) again.
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
[Manage Microsoft Surface Hub](manage-surface-hub.md)
|
||||
|
||||
[Microsoft Surface Hub administrator's guide](surface-hub-administrators-guide.md)
|
||||
@ -43,7 +43,7 @@ The Surface Dock firmware update process shown in Figure 1 follows these steps:
|
||||
|
||||
8. When the Surface Dock is disconnected for a second time, the Surface dock installs the firmware update to the DisplayPort chipset. This process takes up to 3 minutes to apply.
|
||||
|
||||
|
||||
|
||||
|
||||
*1- Driver installation can be performed by Windows Update, manual installation, or automatically downloaded with Microsoft Surface Dock Updater*
|
||||
|
||||
|
||||
@ -39,9 +39,9 @@ You will also find detailed information about the firmware of your Surface devic
|
||||
|
||||
- Touch Firmware
|
||||
|
||||
*Figure 1. System information and firmware version information*
|
||||
|
||||
|
||||
|
||||
*Figure 1. System information and firmware version information*
|
||||
|
||||
You can find up-to-date information about the latest firmware version for your Surface device in the [Surface Update History](https://www.microsoft.com/surface/en-us/support/install-update-activate/surface-update-history) for your device.
|
||||
|
||||
@ -59,21 +59,21 @@ On the **Security** page of Surface UEFI settings, you can set a password to pro
|
||||
|
||||
The password must be at least 6 characters and is case sensitive.
|
||||
|
||||
*Figure 2. Add a password to protect Surface UEFI settings*
|
||||
|
||||
|
||||
|
||||
*Figure 2. Add a password to protect Surface UEFI settings*
|
||||
|
||||
On the **Security** page you can also change the configuration of Secure Boot on your Surface device. Secure Boot technology prevents unauthorized boot code from booting on your Surface device, which protects against bootkit and rootkit-type malware infections. You can disable Secure Boot to allow your Surface device to boot third-party operating systems or bootable media. You can also configure Secure Boot to work with third-party certificates, as shown in Figure 3. Read more about [Secure Boot](https://msdn.microsoft.com/windows/hardware/commercialize/manufacture/desktop/secure-boot-overview) in the TechNet Library.
|
||||
|
||||
*Figure 3. Configure Secure Boot*
|
||||
|
||||
|
||||
|
||||
*Figure 3. Configure Secure Boot*
|
||||
|
||||
You can also enable or disable the Trusted Platform Module (TPM) device on the **Security** page, as shown in Figure 4. The TPM is used to authenticate encryption for your device’s data with BitLocker. Read more about [BitLocker](https://technet.microsoft.com/en-us/itpro/windows/keep-secure/bitlocker-overview) in the TechNet Library.
|
||||
|
||||
*Figure 4. Configure Surface UEFI security settings*
|
||||
|
||||
|
||||
|
||||
*Figure 4. Configure Surface UEFI security settings*
|
||||
|
||||
##Devices
|
||||
|
||||
@ -95,9 +95,9 @@ On the **Devices** page you can enable or disable specific devices and component
|
||||
|
||||
Each device is listed with a slider button that you can move to **On** (enabled) or **Off** (disabled) position, as shown in Figure 5.
|
||||
|
||||
*Figure 5. Enable and disable specific devices*
|
||||
|
||||
|
||||
|
||||
*Figure 5. Enable and disable specific devices*
|
||||
|
||||
##Boot configuration
|
||||
|
||||
@ -115,9 +115,9 @@ You can boot from a specific device immediately, or you can swipe left on that d
|
||||
|
||||
For the specified boot order to take effect, you must set the **Enable Alternate Boot Sequence** option to **On**, as shown in Figure 6.
|
||||
|
||||
*Figure 6. Configure the boot order for your Surface device*
|
||||
|
||||
|
||||
|
||||
*Figure 6. Configure the boot order for your Surface device*
|
||||
|
||||
You can also turn on and off IPv6 support for PXE with the **Enable IPv6 for PXE Network Boot** option, for example when performing a Windows deployment using PXE where the PXE server is configured for IPv4 only.
|
||||
|
||||
@ -125,14 +125,14 @@ You can also turn on and off IPv6 support for PXE with the **Enable IPv6 for PXE
|
||||
|
||||
The **About** page displays regulatory information, such as compliance with FCC rules, as shown in Figure 7.
|
||||
|
||||
*Figure 7. Regulatory information is displayed on the About page*
|
||||
|
||||
|
||||
|
||||
*Figure 7. Regulatory information displayed on the About page*
|
||||
|
||||
##Exit
|
||||
|
||||
Use the **Restart Now** button on the **Exit** page to exit UEFI settings, as shown in Figure 8.
|
||||
|
||||
*Figure 8. Click Restart Now to exit Surface UEFI and restart the device*
|
||||
|
||||
|
||||
|
||||
*Figure 8. Click Restart Now to exit Surface UEFI and restart the device*
|
||||
|
||||
@ -65,24 +65,24 @@ After the creation tool is installed, follow these steps to create a Microsoft S
|
||||
|
||||
3. Click **Start** to acknowledge that you have a USB stick of at least 4 GB connected, as shown in Figure 1.
|
||||
|
||||
|
||||
|
||||
|
||||
Figure 1. Start the Microsoft Surface Data Eraser tool
|
||||
*Figure 1. Start the Microsoft Surface Data Eraser tool*
|
||||
|
||||
4. Select the USB drive of your choice from the **USB Thumb Drive Selection** page as shown in Figure 2, and then click **Start** to begin the USB creation process. The drive you select will be formatted and any existing data on this drive will be lost.
|
||||
>**Note:** If the Start button is disabled, check that your removable drive has a total capacity of at least 4 GB.
|
||||
|
||||
|
||||
|
||||
|
||||
Figure 2. USB thumb drive selection
|
||||
*Figure 2. USB thumb drive selection*
|
||||
|
||||
5. After the creation process is finished, the USB drive has been formatted and all binaries are copied to the USB drive. Click **Success**.
|
||||
|
||||
6. When the **Congratulations** screen is displayed, you can eject and remove the thumb drive. This thumb drive is now ready to be inserted into a Surface device, booted from, and wipe any data on the device. Click **Complete** to finish the USB creation process, as shown in Figure 3.
|
||||
|
||||
|
||||
|
||||
|
||||
Figure 3. Complete the Microsoft Surface Data Eraser USB creation process
|
||||
*Figure 3. Complete the Microsoft Surface Data Eraser USB creation process*
|
||||
|
||||
7. Click **X** to close Microsoft Surface Data Eraser.
|
||||
|
||||
@ -105,9 +105,9 @@ After you create a Microsoft Surface Data Eraser USB stick, you can boot a suppo
|
||||
|
||||
3. When the Surface device boots, a **SoftwareLicenseTerms** text file is displayed.
|
||||
|
||||
|
||||
|
||||
|
||||
Figure 4. Booting the Microsoft Surface Data Eraser USB stick
|
||||
*Figure 4. Booting the Microsoft Surface Data Eraser USB stick*
|
||||
|
||||
4. Read the software license terms, and then close the notepad file.
|
||||
|
||||
@ -123,9 +123,9 @@ After you create a Microsoft Surface Data Eraser USB stick, you can boot a suppo
|
||||
|
||||
7. If you typed **S** to begin the data erase process, the partition that will be erased is displayed, as shown in Figure 5. If this is correct, press **Y** to continue, or **N** to shut down the device.
|
||||
|
||||
|
||||
|
||||
|
||||
Figure 5. Partition to be erased is displayed in Microsoft Surface Data Eraser
|
||||
*Figure 5. Partition to be erased is displayed in Microsoft Surface Data Eraser*
|
||||
|
||||
8. If you pressed **Y** in step 7, due to the destructive nature of the data erasure process, an additional dialog box is displayed to confirm your choice.
|
||||
|
||||
|
||||
@ -60,7 +60,7 @@ The following steps show you how to create a deployment share for Windows 10 th
|
||||
>**Note:** As of SDA version 1.96.0405, SDA will install only the components of the Windows ADK that are required for deployment, as follows:
|
||||
* Deployment tools
|
||||
* User State Migration Tool (USMT)
|
||||
* Windows Preinstallation Environment (WinPE)</br>
|
||||
* Windows Preinstallation Environment (WinPE)</br></br>
|
||||
|
||||
>**Note:** As of SDA version 1.96.0405, SDA will install and use MDT 2013 Update 2. Earlier versions of SDA are compatible only with MDT 2013 Update 1.
|
||||
|
||||
@ -116,7 +116,7 @@ The following steps show you how to create a deployment share for Windows 10 th
|
||||
|
||||
|
||||
|
||||
*Figure 5. The **Installation Progress** window*
|
||||
*Figure 5. The Installation Progress window*
|
||||
|
||||
8. When the SDA process completes the creation of your deployment share, a **Success** window is displayed. Click **Finish** to close the window. At this point your deployment share is now ready to perform a Windows deployment to Surface devices.
|
||||
|
||||
@ -250,7 +250,7 @@ After you have prepared the USB drive for boot, the next step is to generate off
|
||||
|
||||
|
||||
|
||||
*Figure 12. Select the **Update Media Content** option*
|
||||
*Figure 12. Select the Update Media Content option*
|
||||
|
||||
22. The **Update Media Content** window is displayed and shows the progress as the media files are created. When the process completes, click **Finish.**
|
||||
|
||||
@ -358,7 +358,7 @@ To run the Deploy Microsoft Surface task sequence:
|
||||
|
||||
|
||||
|
||||
*Figure 15. Select the **1 – Deploy Microsoft Surface** task sequence*
|
||||
*Figure 15. Select the 1 – Deploy Microsoft Surface task sequence*
|
||||
|
||||
2. On the **Computer Details** page, type a name for the Surface device in the **Computer Name** box. In the **Join a domain** section, type your domain name and credentials as shown in Figure 16, and then click **Next**.
|
||||
|
||||
@ -378,7 +378,7 @@ To run the Deploy Microsoft Surface task sequence:
|
||||
|
||||
|
||||
|
||||
*Figure 17. The **Installation Progress** window*
|
||||
*Figure 17. The Installation Progress window*
|
||||
|
||||
8. When the deployment task sequence completes, a **Success** window is displayed. Click **Finish** to complete the deployment and begin using your Surface device.
|
||||
|
||||
|
||||
@ -34,15 +34,15 @@ To update a Surface Dock with Microsoft Surface Dock Updater, follow these steps
|
||||
|
||||
- If the tool determines that the firmware of your Surface Dock is up to date, a **You have the latest firmware for this Surface Dock** message is displayed, as shown in Figure 1.
|
||||
|
||||
|
||||
|
||||
|
||||
Figure 1. Your Surface Dock firmware is up to date.
|
||||
*Figure 1. Your Surface Dock firmware is up to date*
|
||||
|
||||
- If Microsoft Surface Dock Updater determines that the firmware of your Surface Dock is not up to date, a **This Surface Dock is not running the latest firmware** message is displayed, as shown in Figure 2.
|
||||
|
||||
|
||||
|
||||
|
||||
Figure 2. Your Surface Dock firmware needs to be updated
|
||||
*Figure 2. Your Surface Dock firmware needs to be updated*
|
||||
|
||||
3. To begin the firmware update process, click **Update** on the **Surface Dock Firmware** page.
|
||||
|
||||
@ -50,27 +50,27 @@ To update a Surface Dock with Microsoft Surface Dock Updater, follow these steps
|
||||
|
||||
5. As the firmware update is uploaded to the Surface Dock, a **Progress** page is displayed, as shown in Figure 3. Do not disconnect the Surface Dock while firmware is being uploaded.
|
||||
|
||||
|
||||
|
||||
|
||||
Figure 3. Progress of firmware update upload to Surface Dock
|
||||
*Figure 3. Progress of firmware update upload to Surface Dock*
|
||||
|
||||
6. After the firmware update has successfully uploaded to the Surface Dock, you are prompted to disconnect and then reconnect the Surface Dock from the Surface device, as shown in Figure 4. The main chipset firmware update will be applied while the Surface Dock is disconnected.
|
||||
|
||||
|
||||
|
||||
|
||||
Figure 4. Disconnect and reconnect Surface Dock when prompted
|
||||
*Figure 4. Disconnect and reconnect Surface Dock when prompted*
|
||||
|
||||
7. When the main chipset firmware update is verified, the DisplayPort chipset firmware update will be uploaded to the Surface Dock. Upon completion, a **Success** page is displayed and you will again be prompted to disconnect the Surface Dock, as shown in Figure 5.
|
||||
|
||||
|
||||
|
||||
|
||||
Figure 5. Successful upload of Surface Dock firmware
|
||||
*Figure 5. Successful upload of Surface Dock firmware*
|
||||
|
||||
8. After you disconnect the Surface Dock the DisplayPort firmware update will be installed. This process occurs on the Surface Dock hardware while it is disconnected. The Surface Dock must remain powered for up to 3 minutes after it has been disconnected for the firmware update to successfully install. An **Update in Progress** page is displayed (as shown in Figure 6), with a countdown timer to show the estimated time remaining to complete the firmware update installation.
|
||||
|
||||
|
||||
|
||||
|
||||
Figure 6. Countdown timer to complete firmware installation on Surface Dock
|
||||
*Figure 6. Countdown timer to complete firmware installation on Surface Dock*
|
||||
|
||||
9. If you want to update multiple Surface Docks in one sitting, you can click the **Update another Surface Dock** button to begin the process on the next Surface Dock.
|
||||
|
||||
@ -83,9 +83,9 @@ To update a Surface Dock with Microsoft Surface Dock Updater, follow these steps
|
||||
|
||||
If the Surface Dock firmware update process encounters an installation error with either firmware update, the **Encountered an unexpected error** page may be displayed, as shown in Figure 7.
|
||||
|
||||
|
||||
|
||||
|
||||
Figure 7. Firmware update installation has encountered an error
|
||||
*Figure 7. Firmware update installation has encountered an error*
|
||||
|
||||
Microsoft Surface Dock Updater logs its progress into the Event Log, as shown in Figure 8. If you need to troubleshoot an update through this tool, you will find Surface Dock events recorded with the following event IDs:
|
||||
|
||||
@ -97,9 +97,9 @@ Microsoft Surface Dock Updater logs its progress into the Event Log, as shown in
|
||||
| 12105 | Error |
|
||||
|
||||
|
||||
Figure 8. Surface Dock Updater events in Event Viewer
|
||||
|
||||
|
||||
|
||||
*Figure 8. Surface Dock Updater events in Event Viewer*
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
@ -35,6 +35,7 @@
|
||||
## [Upgrade to Windows 10 with the Microsoft Deployment Toolkit](upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md)
|
||||
## [Upgrade to Windows 10 with System Center Configuration Manager](upgrade-to-windows-10-with-system-center-configuraton-manager.md)
|
||||
## [Configure a PXE server to load Windows PE](configure-a-pxe-server-to-load-windows-pe.md)
|
||||
## [Windows 10 upgrade paths](windows-10-upgrade-paths.md)
|
||||
## [Windows 10 edition upgrade](windows-10-edition-upgrades.md)
|
||||
## [Provision PCs with common settings for initial deployment](provision-pcs-for-initial-deployment.md)
|
||||
## [Provision PCs with apps and certificates for initial deployments](provision-pcs-with-apps-and-certificates.md)
|
||||
|
||||
@ -15,7 +15,8 @@ This topic lists new and updated topics in the [Deploy Windows 10](index.md) doc
|
||||
| New or changed topic | Description |
|
||||
|----------------------|-------------|
|
||||
| [Configure a PXE server to load Windows PE](configure-a-pxe-server-to-load-windows-pe.md) | New |
|
||||
| [User State Migration Tool Technical Reference](usmt-technical-reference.md) | Updated |
|
||||
| [User State Migration Tool Technical Reference](usmt-technical-reference.md) | Updated support statement for Office 2016 |
|
||||
| [Windows 10 upgrade paths](windows-10-upgrade-paths.md) | New |
|
||||
|
||||
## May 2016
|
||||
| New or changed topic | Description |
|
||||
|
||||
BIN
windows/deploy/images/check_grn.png
Normal file
BIN
windows/deploy/images/check_grn.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 20 KiB |
BIN
windows/deploy/images/x_blk.png
Normal file
BIN
windows/deploy/images/x_blk.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 20 KiB |
@ -25,6 +25,7 @@ Learn about deploying Windows 10 for IT professionals.
|
||||
|[Windows 10 edition upgrade](windows-10-edition-upgrades.md) |With Windows 10, you can quickly upgrade from one edition of Windows 10 to another, provided the upgrade path is supported. |
|
||||
| [Provision PCs with common settings for initial deployment](provision-pcs-for-initial-deployment.md) | Create a provisioning package to apply commonly used settings to a PC running Windows 10. |
|
||||
| [Provision PCs with apps and certificates for initial deployments](provision-pcs-with-apps-and-certificates.md) | Create a provisioning package to add apps and certificates to a PC running Windows 10. |
|
||||
|[Windows 10 upgrade paths](windows-10-upgrade-paths.md) |You can upgrade directly to Windows 10 from a previous operating system. |
|
||||
|[Deploy Windows To Go in your organization](deploy-windows-to-go.md) |This topic helps you to deploy Windows To Go in your organization. Before you begin deployment, make sure that you have reviewed the topics [Windows To Go: feature overview](../plan/windows-to-go-overview.md) and [Prepare your organization for Windows To Go](../plan/prepare-your-organization-for-windows-to-go.md) to ensure that you have the correct hardware and are prepared to complete the deployment. You can then use the steps in this topic to start your Windows To Go deployment. |
|
||||
|[Upgrade a Windows Phone 8.1 to Windows 10 Mobile with Mobile Device Management](upgrade-windows-phone-8-1-to-10.md) |This topic describes how to upgrade eligible Windows Phone 8.1 devices to Windows 10 Mobile. |
|
||||
|[Sideload apps in Windows 10](sideload-apps-in-windows-10.md) |Sideload line-of-business apps in Windows 10. |
|
||||
|
||||
@ -15,17 +15,17 @@ author: greg-lindsay
|
||||
- Windows 10
|
||||
- Windows 10 Mobile
|
||||
|
||||
With Windows 10, you can quickly upgrade from one edition of Windows 10 to another, provided the upgrade path is supported. For information on what edition of Windows 10 is right for you, see [Compare Windows 10 Editions](http://go.microsoft.com/fwlink/p/?LinkID=690882).
|
||||
With Windows 10, you can quickly upgrade from one edition of Windows 10 to another, provided the upgrade path is supported. For information on what edition of Windows 10 is right for you, see [Compare Windows 10 Editions](http://go.microsoft.com/fwlink/p/?LinkID=690882). For a comprehensive list of all possible upgrade paths to Windows 10, see [Windows 10 upgrade paths](windows-10-upgrade-paths.md).
|
||||
|
||||
The following table shows the methods you can use to upgrade editions of Windows 10.
|
||||
The following table shows the methods and paths available to change the edition of Windows 10 that is running on your computer.
|
||||
|
||||
|Method |Home > Pro |Home > Education |Pro > Education |Pro > Enterprise |Ent > Education |Mobile > Mobile Enterprise |
|
||||
|-------|-----------|-----------------|----------------|-----------------|----------------|--------|
|
||||
| Using mobile device management (MDM) | | | | | | |
|
||||
| Using a provisioning package | | | | | | |
|
||||
| Using a command-line tool | | | | | | |
|
||||
| Entering a product key manually | | | | | | |
|
||||
| Purchasing a license from the Windows Store | | | | | | |
|
||||
| Using mobile device management (MDM) | | | | | | |
|
||||
| Using a provisioning package | | | | | | |
|
||||
| Using a command-line tool | | | | | | |
|
||||
| Entering a product key manually | | | | | | |
|
||||
| Purchasing a license from the Windows Store | | | | | | |
|
||||
|
||||
**Note**<br>Each desktop edition in the table also has an N and KN edition. These editions have had media-related functionality removed. Devices with N or KN editions installed can be upgraded to corresponding N or KN editions using the same methods.
|
||||
|
||||
|
||||
416
windows/deploy/windows-10-upgrade-paths.md
Normal file
416
windows/deploy/windows-10-upgrade-paths.md
Normal file
@ -0,0 +1,416 @@
|
||||
---
|
||||
title: Windows 10 upgrade paths (Windows 10)
|
||||
description: You can upgrade to Windows 10 from a previous version of Windows, providing the upgrade path is supported.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: mobile
|
||||
author: greg-lindsay
|
||||
---
|
||||
|
||||
# Windows 10 upgrade paths
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 10 Mobile
|
||||
|
||||
## Upgrade paths
|
||||
|
||||
This topic provides a summary of available upgrade paths to Windows 10. You can upgrade to Windows 10 from Windows 7 or a later operating system. This includes upgrading from one release of Windows 10 to later release of Windows 10. Migrating from one edition of Windows 10 to a different edition of the same release is also supported. For more information about migrating to a different edition of Windows 10, see [Windows 10 edition upgrade](windows-10-edition-upgrades.md).
|
||||
|
||||
>**Windows N/KN**: Windows "N" and "KN" editions follow the same upgrade paths shown below. If the pre-upgrade and post-upgrade editions are not the same type (e.g. Windows 8.1 Pro N to Windows 10 Pro), personal data will be kept but applications and settings will be removed during the upgrade process.
|
||||
|
||||
>**Free upgrade**: Some upgrade paths qualify for a free upgrade using Windows Update. For a list of upgrade paths that are available as part of the free upgrade offer, see [Free upgrade paths](#Free-upgrade-paths).
|
||||
|
||||
✔ = Full upgrade is supported including personal data, settings, and applications.<BR>
|
||||
D = Edition downgrade; personal data is maintained, applications and settings are removed.
|
||||
|
||||
<table border="1" cellpadding="3">
|
||||
<tr>
|
||||
<td> </td>
|
||||
<td></td>
|
||||
<td>Windows 10 Home</td>
|
||||
<td>Windows 10 Pro</td>
|
||||
<td>Windows 10 Pro for Education</td>
|
||||
<td>Windows 10 Education</td>
|
||||
<td>Windows 10 Enterprise</td>
|
||||
<td>Windows 10 Mobile</td>
|
||||
<td>Windows 10 Mobile Enterprise</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td rowspan="7" nowrap="nowrap">Windows 7</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Starter</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home Basic</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home Premium</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Professional</td>
|
||||
<td>D</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Ultimate</td>
|
||||
<td>D</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td rowspan="8" nowrap="nowrap">Windows 8</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>(Core)</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Professional</td>
|
||||
<td>D</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Professional WMC</td>
|
||||
<td>D</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Embedded Industry</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td>✔</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Windows RT</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Windows Phone 8</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td rowspan="10" nowrap="nowrap">Windows 8.1</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>(Core)</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Connected</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Professional</td>
|
||||
<td>D</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Professional Student</td>
|
||||
<td>D</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Professional WMC</td>
|
||||
<td>D</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Embedded Industry</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td>✔</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Windows RT</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Windows Phone 8.1</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td rowspan="7" nowrap="nowrap">Windows 10</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Professional</td>
|
||||
<td>D</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td>✔</td>
|
||||
<td>D</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Mobile</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Mobile Enterprise</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td>✔</td>
|
||||
<td>✔</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
## Free upgrade paths
|
||||
|
||||
Windows 10 is offered as a free upgrade for the first year after launch of Windows 10, with the following restrictions:
|
||||
- The offer expires on July 29th, 2016.
|
||||
- The offer applies to devices connected to the Internet with Windows Update enabled.
|
||||
- Upgrading to Windows 10 Pro requires a computer running the Pro or Ultimate version of Windows 7/8/8.1.
|
||||
- Windows Phone 8.0 users must update to Windows 8.1 before upgrading to Windows 10 Mobile<sup>1</sup>.
|
||||
- Editions that are excluded from the free upgrade offer include: Windows 7 Enterprise, Windows 8/8.1 Enterprise, and Windows RT/RT 8.1<sup>2</sup>.
|
||||
|
||||
><sup>1</sup>The availability of Windows 10 Mobile for Windows 8.1 devices will vary by device manufacturer, device model, country or region, mobile operator or service provider, hardware limitations, and other factors. For a list of eligible phones and important info about the upgrade and Windows 10 Mobile, see [Windows 10 specifications](http://windows.com/specsmobile).
|
||||
|
||||
><sup>2</sup>Active Software Assurance customers in volume licensing have the benefit to upgrade to Windows 10 Enterprise outside of this offer. Windows 10 is not supported on devices running the RT versions of Windows 8.
|
||||
|
||||
The following table summarizes the free upgrade paths to Windows 10. For a list of frequently asked questions about the free upgrade to Windows 10, see [Upgrade to Windows 10: FAQ](http://windows.microsoft.com/en-us/windows-10/upgrade-to-windows-10-faq).
|
||||
|
||||
<table border="1" cellpadding="3">
|
||||
<tr>
|
||||
<td> </td>
|
||||
<td>From</td>
|
||||
<td>To</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td BGCOLOR="#a0e4fa" colspan="3">Windows 7</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td></td>
|
||||
<td>Windows 7 Starter</td>
|
||||
<td rowspan="3">Windows 10 Home</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td> </td>
|
||||
<td>Windows 7 Home Basic</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td> </td>
|
||||
<td>Windows 7 Home Premium</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td></td>
|
||||
<td>Windows 7 Professional</td>
|
||||
<td rowspan="2">Windows 10 Pro</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td> </td>
|
||||
<td>Windows 7 Ultimate</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td BGCOLOR="#a0e4fa" colspan="3">Windows 8/8.1</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td></td>
|
||||
<td>Windows Phone 8.1</td>
|
||||
<td>Windows 10 Mobile</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td></td>
|
||||
<td>Windows 8/8.1</td>
|
||||
<td>Windows 10 Home</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td></td>
|
||||
<td>Windows 8/8.1 Pro Professional</td>
|
||||
<td rowspan="2">Windows 10 Pro</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td> </td>
|
||||
<td>Windows 8/8.1 Pro for Students</td>
|
||||
</tr>
|
||||
|
||||
</table>
|
||||
|
||||
## Related Topics
|
||||
|
||||
[Windows 10 deployment scenarios](windows-10-deployment-scenarios.md)<BR>
|
||||
[Windows upgrade and migration considerations](windows-upgrade-and-migration-considerations.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -8,13 +8,13 @@ ms.sitesec: library
|
||||
author: greg-lindsay
|
||||
---
|
||||
|
||||
# Windows Upgrade and Migration Considerations
|
||||
# Windows upgrade and migration considerations
|
||||
Files and application settings can be migrated to new hardware running the Windows® operating system, or they can be maintained during an operating system upgrade on the same computer. This topic summarizes the Microsoft® tools you can use to move files and settings between installations in addition to special considerations for performing an upgrade or migration.
|
||||
|
||||
## Upgrade from a Previous Version of Windows
|
||||
## Upgrade from a previous version of Windows
|
||||
You can upgrade from an earlier version of Windows, which means you can install the new version of Windows and retain your applications, files, and settings as they were in your previous version of Windows. If you decide to perform a custom installation of Windows instead of an upgrade, your applications and settings will not be maintained. Your personal files, and all Windows files and directories, will be moved to a Windows.old folder. You can access your data in the Windows.old folder after Windows Setup is complete.
|
||||
|
||||
## Migrate Files and Settings
|
||||
## Migrate files and settings
|
||||
Migration tools are available to transfer settings from one computer that is running Windows to another. These tools transfer only the program settings, not the programs themselves.
|
||||
|
||||
For more information about application compatibility, see the [Application Compatibility Toolkit (ACT)](http://go.microsoft.com/fwlink/p/?LinkId=131349).
|
||||
@ -29,13 +29,13 @@ With Windows Easy Transfer, files and settings can be transferred using a netwo
|
||||
### Migrate with the User State Migration Tool
|
||||
You can use USMT to automate migration during large deployments of the Windows operating system. USMT uses configurable migration rule (.xml) files to control exactly which user accounts, user files, operating system settings, and application settings are migrated and how they are migrated. You can use USMT for both *side-by-side* migrations, where one piece of hardware is being replaced, or *wipe-and-load* (or *refresh*) migrations, when only the operating system is being upgraded.
|
||||
|
||||
## Upgrade and Migration Considerations
|
||||
## Upgrade and migration monsiderations
|
||||
Whether you are upgrading or migrating to a new version of Windows, you must be aware of the following issues and considerations:
|
||||
|
||||
### Application Compatibility
|
||||
### Application compatibility
|
||||
For more information about application compatibility in Windows, see the [Application Compatibility Toolkit (ACT)](http://go.microsoft.com/fwlink/p/?LinkId=131349).
|
||||
|
||||
### Multilingual Windows Image Upgrades
|
||||
### Multilingual Windows image upgrades
|
||||
When performing multilingual Windows upgrades, cross-language upgrades are not supported by USMT. If you are upgrading or migrating an operating system with multiple language packs installed, you can upgrade or migrate only to the system default user interface (UI) language. For example, if English is the default but you have a Spanish language pack installed, you can upgrade or migrate only to English.
|
||||
|
||||
If you are using a single-language Windows image that matches the system default UI language of your multilingual operating system, the migration will work. However, all of the language packs will be removed, and you will have to reinstall them after the upgrade is completed.
|
||||
@ -43,7 +43,7 @@ If you are using a single-language Windows image that matches the system default
|
||||
### Errorhandler.cmd
|
||||
When upgrading from an earlier version of Windows, if you intend to use Errorhandler.cmd, you must copy this file into the %WINDIR%\\Setup\\Scripts directory on the old installation. This makes sure that if there are errors during the down-level phase of Windows Setup, the commands in Errorhandler.cmd will run.
|
||||
|
||||
### Data Drive ACL Migration
|
||||
### Data drive ACL migration
|
||||
During the configuration pass of Windows Setup, the root access control list (ACL) on drives formatted for NTFS that do not appear to have an operating system will be changed to the default Windows XP ACL format. The ACLs on these drives are changed to enable authenticated users to modify access on folders and files.
|
||||
|
||||
Changing the ACLs may affect the performance of Windows Setup if the default Windows XP ACLs are applied to a partition with a large amount of data. Because of these performance concerns, you can change the following registry value to disable this feature:
|
||||
@ -57,7 +57,10 @@ Value: "DDACLSys_Disabled" = 1
|
||||
This feature is disabled if this registry key value exists and is configured to `1`.
|
||||
|
||||
## Related topics
|
||||
- [User State Migration Tool (USMT) Overview Topics](usmt-topics.md)
|
||||
[User State Migration Tool (USMT) Overview Topics](usmt-topics.md)<BR>
|
||||
[Windows 10 upgrade paths](windows-10-upgrade-paths.md)<BR>
|
||||
[Windows 10 edition upgrade](windows-10-edition-upgrades.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -28,6 +28,7 @@
|
||||
#### [Testing scenarios for enterprise data protection (EDP)](testing-scenarios-for-edp.md)
|
||||
## [Use Windows Event Forwarding to help with intrusion detection](use-windows-event-forwarding-to-assist-in-instrusion-detection.md)
|
||||
## [VPN profile options](vpn-profile-options.md)
|
||||
## [Windows security baselines](windows-security-baselines.md)
|
||||
## [Security technologies](security-technologies.md)
|
||||
### [Access Control Overview](access-control.md)
|
||||
#### [Dynamic Access Control Overview](dynamic-access-control.md)
|
||||
@ -680,7 +681,6 @@
|
||||
#### [Minimum requirements](minimum-requirements-windows-defender-advanced-threat-protection.md)
|
||||
#### [Data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md)
|
||||
#### [Onboard endpoints and set up access](onboard-configure-windows-defender-advanced-threat-protection.md)
|
||||
<!--##### [Service onboarding](service-onboarding-windows-defender-advanced-threat-protection.md)-->
|
||||
##### [Configure endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
|
||||
##### [Configure proxy and Internet settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md)
|
||||
##### [Additional configuration settings](additional-configuration-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -19,6 +19,7 @@ This topic lists new and updated topics in the [Keep Windows 10 secure](index.md
|
||||
|[Create an enterprise data protection (EDP) policy using Microsoft Intune](create-edp-policy-using-intune.md) |Added an update about needing to reconfigure your enterprise data protection app rules after delivery of the June service update. |
|
||||
| [Windows Firewall with Advanced Security](windows-firewall-with-advanced-security.md) (multiple topics) | New |
|
||||
| [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) (mutiple topics) | New security monitoring reference topics |
|
||||
| [Windows security baselines](windows-security-baselines.md) | New |
|
||||
|
||||
## May 2016
|
||||
|
||||
|
||||
@ -752,7 +752,7 @@ To modify the policy rule options of an existing code integrity policy, use the
|
||||
|
||||
You can set several rule options within a code integrity policy. Table 2 lists each rule and its high-level meaning.
|
||||
|
||||
Table 2. Code integrity policy - policy rule options
|
||||
#### Table 2. Code integrity policy - policy rule options
|
||||
|
||||
| Rule option | Description |
|
||||
|------------ | ----------- |
|
||||
@ -769,15 +769,15 @@ Table 2. Code integrity policy - policy rule options
|
||||
| **10 Enabled:Boot Audit on Failure** | Used when the code integrity policy is in enforcement mode. When a driver fails during startup, the code integrity policy will be placed in audit mode so that Windows will load. Administrators can validate the reason for the failure in the CodeIntegrity event log. |
|
||||
File rule levels allow administrators to specify the level at which they want to trust their applications. This level of trust could be as low as the hash of each binary and as high as a PCA certificate. File rule levels are specified both when you create a new code integrity policy from a scan and when you create a policy from audit events. In addition, to combine rule levels found in multiple policies, you can merge the policies. When merged, code integrity policies combine their file rules. Each file rule level has its benefit and disadvantage. Use Table 3 to select the appropriate protection level for your available administrative resources and Device Guard deployment scenario.
|
||||
|
||||
Table 3. Code integrity policy - file rule levels
|
||||
#### Table 3. Code integrity policy - file rule levels
|
||||
|
||||
| Rule level | Description |
|
||||
|----------- | ----------- |
|
||||
| **Hash** | Specifies individual hash values for each discovered binary. Although this level is specific, it can cause additional administrative overhead to maintain the current product versions’ hash values. Each time a binary is updated, the hash value changes, therefore requiring a policy update. |
|
||||
| **FileName** | Specifies individual binary file names. Although the hash values for an application are modified when updated, the file names are typically not. This offers less specific security than the hash level but does not typically require a policy update when any binary is modified. |
|
||||
| **SignedVersion** | This combines the publisher rule with a file version number. This option allows anything from the specified publisher, with a file version at or above the specified version number, to run. |
|
||||
| **SignedVersion** | This combines the publisher rule with a version number. This option allows anything from the specified publisher, with a version at or above the specified version number, to run. |
|
||||
| **Publisher** | This is a combination of the PCA certificate and the common name (CN) on the leaf certificate. In the scenario that a PCA certificate is used to sign multiple companies’ applications (such as VeriSign), this rule level allows organizations to trust the PCA certificate but only for the company whose name is on the leaf certificate (for example, Intel for device drivers). This level trusts a certificate with a long validity period but only when combined with a trusted leaf certificate. |
|
||||
| **FilePublisher** | This is a combination of the publisher file rule level and the SignedVersion rule level. Any signed file from the trusted publisher that is the specified version or newer is trusted. |
|
||||
| **FilePublisher** | This is a combination of “FileName” plus “Publisher” (PCA certificate with CN of leaf) plus a minimum version number. This option trusts specific files from the specified publisher, with a version at or above the specified version number. |
|
||||
| **LeafCertificate** | Adds trusted signers at the individual signing certificate level. The benefit of using this level versus the individual hash level is that new versions of the product will have different hash values but typically the same signing certificate. Using this level, no policy update would be needed to run the new version of the application. However, leaf certificates have much shorter validity periods than PCA certificates, so additional administrative overhead is associated with updating the code integrity policy when these certificates expire. |
|
||||
| **PcaCertificate** | Adds the highest certificate in the provided certificate chain to signers. This is typically one certificate below the root certificate, because the scan does not validate anything above the presented signature by going online or checking local root stores. |
|
||||
| **RootCertificate** | Currently unsupported. |
|
||||
|
||||
@ -27,6 +27,7 @@ Learn about keeping Windows 10 and Windows 10 Mobile secure.
|
||||
| [Protect your enterprise data using enterprise data protection (EDP)](protect-enterprise-data-using-edp.md) | With the increase of employee-owned devices in the enterprise, there’s also an increasing risk of accidental data leak through apps and services, like email, social media, and the public cloud, which are outside of the enterprise’s control. For example, when an employee sends the latest engineering pictures from their personal email account, copies and pastes product info into a tweet, or saves an in-progress sales report to their public cloud storage. |
|
||||
| [Use Windows Event Forwarding to help with intrusion detection](use-windows-event-forwarding-to-assist-in-instrusion-detection.md) | Learn about an approach to collect events from devices in your organization. This article talks about events in both normal operations and when an intrusion is suspected. |
|
||||
| [VPN profile options](vpn-profile-options.md) | Virtual private networks (VPN) let you give your users secure remote access to your company network. Windows 10 adds useful new VPN profile options to help you manage how users connect. |
|
||||
| [Windows security baselines](windows-security-baselines.md) | Learn why you should use security baselines in your organization. |
|
||||
| [Security technologies](security-technologies.md) | Learn more about the different security technologies that are available in Windows 10 and Windows 10 Mobile. |
|
||||
| [Enterprise security guides](windows-10-enterprise-security-guides.md) | Get proven guidance to help you better secure and protect your enterprise by using technologies such as Credential Guard, Device Guard, Microsoft Passport, and Windows Hello. This section offers technology overviews and step-by-step guides. |
|
||||
|
||||
|
||||
56
windows/keep-secure/windows-security-baselines.md
Normal file
56
windows/keep-secure/windows-security-baselines.md
Normal file
@ -0,0 +1,56 @@
|
||||
---
|
||||
title: Windows security baselines (Windows 10)
|
||||
description: Use this topic to learn what security baselines are and how you can use them in your organization to help keep your devices secure.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Windows security baselines
|
||||
|
||||
Microsoft is dedicated to provide our customers with a secure operating system, such as Windows 10 and Windows Server, as well as secure apps, such as Microsoft Edge. In addition to the security assurance of its products, Microsoft also enables you to have fine control of your environments by providing various configuration capabilities. Even though Windows and Windows Server are designed to be secure out-of-the-box, a large number of organizations still want more granular control of their security configurations. To navigate these large number of controls, organizations need guidance for configuring various security features. Microsoft provides this guidance in the form of security baselines.
|
||||
|
||||
We recommend implementing an industry-standard configuration that is broadly known and well-tested, such as a Mirosoft security baseline, as opposed to creating one yourself. This helps increase flexibility and reduce costs.
|
||||
|
||||
## What are security baselines?
|
||||
|
||||
Every organization faces security threats. However, the types of security threats that are of most concern to one organization can be completely different from another organization. For example, an e-commerce company may focus on protecting their Internet-facing web apps, while a hospital may focus on protecting confidential patient information. The one thing that all organizations have in common is a need to keep their apps and devices secure. These devices must be compliant with the security standards (or security baselines) defined by the organization.
|
||||
|
||||
A security baseline is a collection of settings that have a security impact and include Microsoft’s recommended value for configuring those settings along with guidance on the security impact of those settings. These settings are based on feedback from Microsoft security engineering teams, product groups, partners, and
|
||||
customers.
|
||||
|
||||
## Why are security baselines needed?
|
||||
|
||||
Security baselines are an essential benefit to customers because they bring together expert knowlege from Microsoft, partners, and customers.
|
||||
|
||||
For example, there are over 3,000 Group Policy settings for Windows 10, which does not include over 1,800 Internet Explorer 11 settings. Of those 3,800 settings, only some of them are security-related. While Microsoft provides extensive guidance on different security features, going through each of them can take a long time. You would have to determine the security impact of each setting on your own. After you've done that, you still need to determine what values each of these settings should be.
|
||||
|
||||
In modern organizations, the security threat landscape is constantly evolving. IT pros and policy makers must keep current with security threats and changes to Windows security settings to help mitigate these threats.
|
||||
|
||||
To help faster deployments and increase the ease of managing Windows, Microsoft provides customers with security baselines that are available in formats that can be consumed, such as Group Policy Objects backups.
|
||||
|
||||
## How can you use security baselines?
|
||||
|
||||
You can use security baselines to:
|
||||
|
||||
- Ensure that user and device configuration settings are compliant with the baseline.
|
||||
- Set configuration settings. For example, you can use Group Policy, System Center Configuration Manager, or Microsoft Intune to configure a device with the setting values specified in the baseline.
|
||||
|
||||
|
||||
## Where can I get the security baselines?
|
||||
|
||||
Here's a list of security baselines that are currently available.
|
||||
|
||||
> **Note:** If you want to know what has changed with each security baseline, or if you want to stay up-to-date on what’s happening with them, check out the [Microsoft Security Guidance](http://blogs.technet.microsoft.com/secguide) blog.
|
||||
|
||||
### Windows 10 security baselines
|
||||
|
||||
- [Windows 10, Version 1511 security baseline](http://go.microsoft.com/fwlink/p/?LinkID=799381)
|
||||
- [Windows 10, Version 1507 security baseline](http://go.microsoft.com/fwlink/p/?LinkID=799380)
|
||||
|
||||
### Windows Server security baselines
|
||||
|
||||
- [Windows Server 2012 R2 security baseline](http://go.microsoft.com/fwlink/p/?LinkID=799382)
|
||||
|
||||
@ -18,7 +18,7 @@ author: jdeckerMS
|
||||
|
||||
> **Looking for Windows Embedded 8.1 Industry information?** See [Assigned Access]( http://go.microsoft.com/fwlink/p/?LinkId=613653)
|
||||
|
||||
A single-use device is easy to set up in Windows 10 for desktop editions (Pro, Enterprise, and Education). For a kiosk device to run a Universal Windows app, use the **assigned access** feature. For a kiosk device (Windows 10 Enterprise or Education) to run a Classic Windows application, use **Shell Launcher** to set a custom user interface as the shell. To return the device to the regular shell, see [Sign out of assigned access](#sign-out-of-assigned-access).
|
||||
A single-use or *kiosk* device is easy to set up in Windows 10 for desktop editions (Pro, Enterprise, and Education). For a kiosk device to run a Universal Windows app, use the **assigned access** feature. For a kiosk device (Windows 10 Enterprise or Education) to run a Classic Windows application, use **Shell Launcher** to set a custom user interface as the shell. To return the device to the regular shell, see [Sign out of assigned access](#sign-out-of-assigned-access).
|
||||
|
||||
**Note**
|
||||
A Universal Windows app is built on the Universal Windows Platform (UWP), which was first introduced in Windows 8 as the Windows Runtime. A Classic Windows application uses the Classic Windows Platform (CWP) (e.g., COM, Win32, WPF, WinForms, etc.) and is typically launched using an .EXE or .DLL file.
|
||||
@ -80,9 +80,7 @@ Using assigned access, Windows 10 runs the designated Universal Windows app abo
|
||||
|
||||
- A domain or local user account.
|
||||
|
||||
The user account must have logged on at least once before you set up assigned access, or no apps will be available for that account. To set up assigned access using MDM, you need the user account (domain\\account).
|
||||
|
||||
- A Universal Windows app that is installed for that account and is an above lock screen app. For details on building an above lock screen app, see [Kiosk apps for assigned access: Best practices](http://go.microsoft.com/fwlink/p/?LinkId=708386).
|
||||
- A Universal Windows app that is installed or provisioned for that account and is an above lock screen app. For more information, see [Guidelines for choosing an app for assigned access](guidelines-for-assigned-access-app.md). For details on building an above lock screen app, see [Kiosk apps for assigned access: Best practices](http://go.microsoft.com/fwlink/p/?LinkId=708386).
|
||||
|
||||
The app can be your own company app that you have made available in your own app Store. To set up assigned access using MDM or PowerShell, you also need the Application User Model ID (AUMID) for the app. [Learn how to get the AUMID](http://go.microsoft.com/fwlink/p/?LinkId=614867).
|
||||
|
||||
@ -128,7 +126,6 @@ When you build a provisioning package, you may include sensitive information in
|
||||
|
||||
2. Choose **Advanced provisioning**.
|
||||
|
||||
|
||||
3. Name your project, and click **Next**.
|
||||
|
||||
4. Choose **All Windows desktop editions** and click **Next**.
|
||||
@ -182,7 +179,9 @@ When you build a provisioning package, you may include sensitive information in
|
||||
|
||||
### Set up assigned access using Windows PowerShell
|
||||
|
||||
You can use any of the following PowerShell cmdlets to set up assigned access on multiple devices. To open PowerShell on Windows 10, search for PowerShell and find **Windows PowerShell Desktop app** in the results.
|
||||
You can use any of the following PowerShell cmdlets to set up assigned access on multiple devices.
|
||||
|
||||
To open PowerShell on Windows 10, search for PowerShell and find **Windows PowerShell Desktop app** in the results.
|
||||
|
||||
```
|
||||
Set-AssignedAccess -AppUserModelId <AUMID> -UserName <username>
|
||||
@ -195,6 +194,7 @@ Set-AssignedAccess -AppUserModelId <AUMID> -UserSID <usersid>
|
||||
```
|
||||
Set-AssignedAccess -AppName <CustomApp> -UserName <username>
|
||||
```
|
||||
> **Note:** To set up assigned access using `-AppName`, the user account that you specify for assigned access must have logged on at least once.
|
||||
|
||||
```
|
||||
Set-AssignedAccess -AppName <CustomApp> -UserSID <usersid>
|
||||
@ -213,7 +213,7 @@ Clear-AssignedAccess
|
||||
|
||||
### Set up automatic logon
|
||||
|
||||
When your kiosk device restarts, whether from an update or power outage, you can log on the assigned access account manually or you can configure the device to log on to the assigned access account automatically.
|
||||
When your kiosk device restarts, whether from an update or power outage, you can log on the assigned access account manually or you can configure the device to log on to the assigned access account automatically. Make sure that Group Policy settings applied to the device do not prevent automatic logon.
|
||||
|
||||
Edit the registry to have an account automatically logged on.
|
||||
|
||||
@ -221,7 +221,6 @@ Edit the registry to have an account automatically logged on.
|
||||
|
||||
**Note**
|
||||
If you are not familiar with Registry Editor, [learn how to modify the Windows registry](http://go.microsoft.com/fwlink/p/?LinkId=615002).
|
||||
|
||||
|
||||
|
||||
2. Go to
|
||||
|
||||
Reference in New Issue
Block a user