mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-16 15:27:22 +00:00
Dani Halfin
GitHub
commit
041f829096
@ -302,6 +302,7 @@ Although all new Office 365 Education subscriptions have automatic licensing ena
|
||||
| Disable | `Set-MsolCompanySettings -AllowAdHocSubscriptions $false` |
|
||||
|
||||
<p>
|
||||
|
||||
### Enable Azure AD Premium
|
||||
|
||||
When you create your Office 365 subscription, you create an Office 365 tenant that includes an Azure AD directory. Azure AD is the centralized repository for all your student and faculty accounts in Office 365, Intune, and other Azure AD–integrated apps. Azure AD is available in Free, Basic, and Premium editions. Azure AD Free, which is included in Office 365 Education, has fewer features than Azure AD Basic, which in turn has fewer features than Azure AD Premium.
|
||||
@ -450,6 +451,7 @@ Several methods are available to bulk-import user accounts into AD DS domains. T
|
||||
| Windows PowerShell | This scripting language natively supports cmdlets to manage AD DS objects, including user and group objects. Select this method if you’re comfortable with Window PowerShell scripting. For more information about using Windows PowerShell, see [Import Bulk Users to Active Directory](https://blogs.technet.microsoft.com/bettertogether/2011/01/09/import-bulk-users-to-active-directory/) and [PowerShell: Bulk create AD Users from CSV file](https://social.technet.microsoft.com/wiki/contents/articles/24541.powershell-bulk-create-ad-users-from-csv-file.aspx). |
|
||||
|
||||
<p>
|
||||
|
||||
### Create a source file that contains the user and group accounts
|
||||
|
||||
After you have selected your user and group account bulk import method, you’re ready to create the source file that contains the user and group account. You’ll use the source file as the input to the import process. The source file format depends on the method you selected. Table 6 lists the source file format for the bulk import methods.
|
||||
@ -464,6 +466,7 @@ After you have selected your user and group account bulk import method, you’re
|
||||
| Windows PowerShell | Windows PowerShell can use any .csv file format you want to create as a source file for the bulk-import process. To create the .csv file, use software such as Excel. For examples of how to format your source file in CSV format, see [Import Bulk Users to Active Directory](https://blogs.technet.microsoft.com/bettertogether/2011/01/09/import-bulk-users-to-active-directory/) and [PowerShell: Bulk create AD Users from CSV file](https://social.technet.microsoft.com/wiki/contents/articles/24541.powershell-bulk-create-ad-users-from-csv-file.aspx). |
|
||||
|
||||
<p>
|
||||
|
||||
### Import the user accounts into AD DS
|
||||
|
||||
With the bulk-import source file finished, you’re ready to import the user and group accounts into AD DS. The steps for importing the file are slightly different for each method.
|
||||
@ -575,6 +578,7 @@ After you create the Microsoft Store for Business portal, configure it by using
|
||||
| Private store | Allows you to change the organization name used in your Microsoft Store for Business portal. When you create your portal, the private store uses the organization name that you used to create your Office 365 subscription. For more information, see [Distribute apps using your private store](https://technet.microsoft.com/itpro/windows/manage/distribute-apps-from-your-private-store). |
|
||||
|
||||
<p>
|
||||
|
||||
### Find, acquire, and distribute apps in the portal
|
||||
|
||||
Now that you have created your Microsoft Store for Business portal, you’re ready to find, acquire, and distribute apps that you will add to your portal. You do this by using the Inventory page in Microsoft Store for Business.
|
||||
@ -1269,6 +1273,7 @@ Follow the same steps described in the <a href="#deploy-windows-10-to-devices" d
|
||||
</tbody>
|
||||
</table>
|
||||
<p>
|
||||
|
||||
### Summary
|
||||
|
||||
Now, you have identified the tasks you need to perform monthly, at the end of an academic year or semester, and as required. Your school configuration should match the typical school configuration that you saw in the [Plan a typical school configuration](#plan-a-typical-school-configuration) section. By performing these maintenance tasks you help ensure that your school stays secure and is configured as you specified.
|
||||
@ -1278,5 +1283,4 @@ Now, you have identified the tasks you need to perform monthly, at the end of an
|
||||
<li><a href="https://go.microsoft.com/fwlink/p/?LinkId=623254" data-raw-source="[Try it out: Windows 10 deployment (for educational institutions)](https://go.microsoft.com/fwlink/p/?LinkId=623254)">Try it out: Windows 10 deployment (for educational institutions)</a></li>
|
||||
<li><a href="https://go.microsoft.com/fwlink/p/?LinkId=623255" data-raw-source="[Try it out: Windows 10 in the classroom](https://go.microsoft.com/fwlink/p/?LinkId=623255)">Try it out: Windows 10 in the classroom</a></li>
|
||||
<li><a href="https://go.microsoft.com/fwlink/p/?LinkId=623249" data-raw-source="[Chromebook migration guide](https://go.microsoft.com/fwlink/p/?LinkId=623249)">Chromebook migration guide</a></li>
|
||||
</ul>
|
||||
|
||||
</ul>
|
||||
@ -142,7 +142,7 @@ Stop-Website "Microsoft BitLocker Administration and Monitoring"
|
||||
|
||||
### Move the Recovery Database from Server A to Server B
|
||||
|
||||
Use Windows Explorer to move the **MBAM Compliance Status Database Data.bak** file from Server A to Server B.
|
||||
Use Windows Explorer to move the **MBAM Recovery Database Data.bak** file from Server A to Server B.
|
||||
|
||||
To automate this procedure, you can use Windows PowerShell to run a command that is similar to the following:
|
||||
|
||||
|
||||
@ -38,7 +38,7 @@ There are a couple of things we need to know when you pay for apps. You can add
|
||||
## Allow users to shop
|
||||
|
||||
**Allow users to shop** controls the shopping experience in Microsoft Store for Education. When this setting is on, **Purchasers** and **Basic Purchasers** can purchase products and services from Microsoft Store for Education. If your school chooses to closely control how purchases are made, admins can turn off **Allow users to shop**. When the setting is off:
|
||||
- The shopping experience is not availalbe
|
||||
- The shopping experience is not available
|
||||
- **Purchasers** and **Basic Purchasers** can't purchase products and services from Microsoft Store for Education
|
||||
- Admins can't assign shopping roles to users
|
||||
- Products and services previously purchased by **Basic Purchasers** can be managed by admins.
|
||||
|
||||
@ -26,7 +26,7 @@ The content below are the different versions of the DDF for this CSP.
|
||||
- [EnterpriseAPN CSP version 1.1 DDF](#enterpriseapn-csp-version-1-1-ddf)
|
||||
- [EnterpriseAPN CSP version 1.2 DDF](#enterpriseapn-csp-version-1-2-ddf)
|
||||
|
||||
### EnterpriseAPN CSP version 1.0 DDF
|
||||
### <a id="enterpriseapn-csp-version-1-0-ddf" />EnterpriseAPN CSP version 1.0 DDF
|
||||
|
||||
``` syntax
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
@ -314,7 +314,7 @@ The content below are the different versions of the DDF for this CSP.
|
||||
</MgmtTree>
|
||||
```
|
||||
|
||||
### EnterpriseAPN CSP version 1.1 DDF
|
||||
### <a id="enterpriseapn-csp-version-1-1-ddf" />EnterpriseAPN CSP version 1.1 DDF
|
||||
|
||||
``` syntax
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
@ -739,7 +739,7 @@ The content below are the different versions of the DDF for this CSP.
|
||||
</MgmtTree>
|
||||
```
|
||||
|
||||
### EnterpriseAPN CSP version 1.2 DDF
|
||||
### <a id="enterpriseapn-csp-version-1-2-ddf" />EnterpriseAPN CSP version 1.2 DDF
|
||||
|
||||
``` syntax
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
|
||||
@ -228,7 +228,7 @@ All Windows 10-based devices can be connected to an MDM. You can connect to an
|
||||
|
||||
|
||||
|
||||
4. Click the **Enroll only in device management** link (available in servicing build 14393.82, KB3176934) . For older builds, use [Connecting your Windows 10-based device to work using a deep link](#connecting-your-windows-10-based-device-to-work-using-a-deep-link).
|
||||
4. Click the **Enroll only in device management** link (available in servicing build 14393.82, KB3176934) . For older builds, use [Connecting your Windows 10-based device to work using a deep link](#connecting-your-windows10-based-device-to-work-using-a-deep-link).
|
||||
|
||||
|
||||
|
||||
@ -255,7 +255,7 @@ All Windows 10-based devices can be connected to an MDM. You can connect to an
|
||||
|
||||
|
||||
|
||||
3. Click the **Enroll only in device management** link. This is only available in the servicing build 14393.82 (KB3176934). For older builds, use [Connecting your Windows 10-based device to work using a deep link](#connecting-your-windows-10-based-device-to-work-using-a-deep-link).
|
||||
3. Click the **Enroll only in device management** link. This is only available in the servicing build 14393.82 (KB3176934). For older builds, use [Connecting your Windows 10-based device to work using a deep link](#connecting-your-windows10-based-device-to-work-using-a-deep-link).
|
||||
|
||||
|
||||
|
||||
|
||||
@ -33,7 +33,7 @@ For details about Microsoft mobile device management protocols for Windows 10 s
|
||||
|
||||
- **Breaking changes and known issues**
|
||||
- [Get command inside an atomic command is not supported](#get-command-inside-an-atomic-command-is-not-supported)
|
||||
- [Notification channel URI not preserved during upgrade from Windows 8.1 to Windows 10](#notification-channel-uri-not-preserved-during-upgrade-from-windows-81-to-windows-10)
|
||||
- [Notification channel URI not preserved during upgrade from Windows 8.1 to Windows 10](#notification-channel-uri-not-preserved-during-upgrade-from-windows81-to-windows10)
|
||||
- [Apps installed using WMI classes are not removed](#apps-installed-using-wmi-classes-are-not-removed)
|
||||
- [Passing CDATA in SyncML does not work](#passing-cdata-in-syncml-does-not-work)
|
||||
- [SSL settings in IIS server for SCEP must be set to "Ignore"](#ssl-settings-in-iis-server-for-scep-must-be-set-to-ignore)
|
||||
@ -43,15 +43,15 @@ For details about Microsoft mobile device management protocols for Windows 10 s
|
||||
- [Version information for mobile devices](#version-information-for-mobile-devices)
|
||||
- [Upgrading Windows Phone 8.1 devices with app whitelisting using ApplicationRestriction policy has issues](#upgrading-windows-phone-81-devices-with-app-whitelisting-using-applicationrestriction-policy-has-issues)
|
||||
- [Apps dependent on Microsoft Frameworks may get blocked in phones prior to build 10586.218](#apps-dependent-on-microsoft-frameworks-may-get-blocked-in-phones-prior-to-build-10586218)
|
||||
- [Multiple certificates might cause Wi-Fi connection instabilities in Windows 10 Mobile](#multiple-certificates-might-cause-wi-fi-connection-instabilities-in-windows-10-mobile)
|
||||
- [Multiple certificates might cause Wi-Fi connection instabilities in Windows 10 Mobile](#mcmcwfciw10mobile)
|
||||
- [Remote PIN reset not supported in Azure Active Directory joined mobile devices](#remote-pin-reset-not-supported-in-azure-active-directory-joined-mobile-devices)
|
||||
- [MDM client will immediately check-in with the MDM server after client renews WNS channel URI](#mdm-client-will-immediately-check-in-with-the-mdm-server-after-client-renews-wns-channel-uri)
|
||||
- [User provisioning failure in Azure Active Directory joined Windows 10 PC](#user-provisioning-failure-in-azure-active-directory-joined-windows-10-pc)
|
||||
- [User provisioning failure in Azure Active Directory joined Windows 10 PC](#user-provisioning-failure-in-azure-active-directory-joined-windows10-pc)
|
||||
- [Requirements to note for VPN certificates also used for Kerberos Authentication](#requirements-to-note-for-vpn-certificates-also-used-for-kerberos-authentication)
|
||||
- [Device management agent for the push-button reset is not working](#device-management-agent-for-the-push-button-reset-is-not-working)
|
||||
|
||||
- **Frequently Asked Questions**
|
||||
- [Can there be more than 1 MDM server to enroll and manage devices in Windows 10?](#can-there-be-more-than-1-mdm-server-to-enroll-and-manage-devices-in-windows-10)
|
||||
- [Can there be more than 1 MDM server to enroll and manage devices in Windows 10?](#ctbmt1mdmsteamdiw10)
|
||||
- [How do I set the maximum number of Azure Active Directory joined devices per user?](#how-do-i-set-the-maximum-number-of-azure-active-directory-joined-devices-per-user)
|
||||
- [What is dmwappushsvc?](#what-is-dmwappushsvc)
|
||||
|
||||
@ -1649,7 +1649,7 @@ Applies only to phone prior to build 10586.218: When ApplicationManagement/Appli
|
||||
<App ProductId="{00000000-0000-0000-0000-000000000000}" PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US"/>
|
||||
```
|
||||
|
||||
### Multiple certificates might cause Wi-Fi connection instabilities in Windows 10 Mobile
|
||||
### <a id="mcmcwfciw10mobile" />Multiple certificates might cause Wi-Fi connection instabilities in Windows 10 Mobile
|
||||
|
||||
In your deployment, if you have multiple certificates provisioned on the device and the Wi-Fi profile provisioned does not have a strict filtering criteria, you may see connection failures when connecting to Wi-Fi. The solution is to ensure that the Wi-Fi profile provisioned has strict filtering criteria such that it matches only one certificate.
|
||||
|
||||
@ -1845,7 +1845,7 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
|
||||
## Frequently Asked Questions
|
||||
|
||||
|
||||
### **Can there be more than 1 MDM server to enroll and manage devices in Windows 10?**
|
||||
### <a id="ctbmt1mdmsteamdiw10" />**Can there be more than 1 MDM server to enroll and manage devices in Windows 10?**
|
||||
No. Only one MDM is allowed.
|
||||
|
||||
### **How do I set the maximum number of Azure Active Directory joined devices per user?**
|
||||
|
||||
@ -738,7 +738,7 @@ The following diagram shows the Policy configuration service provider in tree fo
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="./policy-csp-cryptography.md#cryptographyallowfipsalgorithmpolicy" id="CryptographyAllowFipsAlgorithmPolicy">Cryptography/AllowFipsAlgorithmPolicy</a>
|
||||
<a href="./policy-csp-cryptography.md#cryptographyallowfipsalgorithmpolicy" id="cryptographyallowfipsalgorithmpolicy">Cryptography/AllowFipsAlgorithmPolicy</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-cryptography.md#cryptographytlsciphersuites" id="cryptographytlsciphersuites">Cryptography/TLSCipherSuites</a>
|
||||
|
||||
@ -83,12 +83,17 @@ The following list shows the supported values:
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
> [!NOTE]
|
||||
> To manage encryption of PCs and devices, use [BitLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp)
|
||||
|
||||
Footnote:
|
||||
|
||||
- 1 - Added in Windows 10, version 1607.
|
||||
- 2 - Added in Windows 10, version 1703.
|
||||
- 3 - Added in Windows 10, version 1709.
|
||||
- 4 - Added in Windows 10, version 1803.
|
||||
- 5 - Added in Windows 10, version 1809.
|
||||
- 6 - Added in Windows 10, version 1903.
|
||||
|
||||
<!--/Policies-->
|
||||
|
||||
|
||||
@ -19,14 +19,23 @@ manager: dansimp
|
||||
## Cryptography policies
|
||||
|
||||
|
||||
<<<<<<< HEAD
|
||||
* [Cryptography/AllowFipsAlgorithmPolicy](#CryptographyAllowFipsAlgorithmPolicy)
|
||||
* [Cryptography/TLSCipherSuites](#CryptographyTLSCipherSuites)
|
||||
=======
|
||||
* [Cryptography/AllowFipsAlgorithmPolicy](#cryptographyallowfipsalgorithmpolicy)
|
||||
* [Cryptography/TLSCipherSuites](#cryptographytlsciphersuites)
|
||||
>>>>>>> master
|
||||
* [Cryptography/Microsoft Surface Hub](#cryptography-policies-supported-by-microsoft-surface-hub)
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
|
||||
<<<<<<< HEAD
|
||||
## <a id="CryptographyAllowFipsAlgorithmPolicy" />Cryptography/AllowFipsAlgorithmPolicy
|
||||
=======
|
||||
## Cryptography/AllowFipsAlgorithmPolicy
|
||||
>>>>>>> master
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
|
||||
@ -68,7 +77,11 @@ The following list shows the supported values:
|
||||
|
||||
<!--Policy-->
|
||||
|
||||
<<<<<<< HEAD
|
||||
## <a id="CryptographyTLSCipherSuites" />Cryptography/TLSCipherSuites
|
||||
=======
|
||||
## Cryptography/TLSCipherSuites
|
||||
>>>>>>> master
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
|Home|Pro|Business |Enterprise |Education |Mobile |Mobile Enterprise |
|
||||
@ -105,8 +118,8 @@ Footnote:
|
||||
<!--StartSurfaceHub-->
|
||||
## Cryptography policies supported by Microsoft Surface Hub
|
||||
|
||||
- [Cryptography/AllowFipsAlgorithmPolicy](#cryptography-allowfipsalgorithmpolicy)
|
||||
- [Cryptography/TLSCipherSuites](#cryptography-tlsciphersuites)
|
||||
- [Cryptography/AllowFipsAlgorithmPolicy](#CryptographyAllowFipsAlgorithmPolicy)
|
||||
- [Cryptography/TLSCipherSuites](#CryptographyTLSCipherSuites)
|
||||
<!--EndSurfaceHub-->
|
||||
|
||||
|
||||
|
||||
@ -2638,6 +2638,9 @@ GP Info:
|
||||
<!--Policy-->
|
||||
<a href="" id="localpoliciessecurityoptions-recoveryconsole-allowautomaticadministrativelogon"></a>**LocalPoliciesSecurityOptions/RecoveryConsole_AllowAutomaticAdministrativeLogon**
|
||||
|
||||
> [!Warning]
|
||||
> Starting with Windows 10 version 1803, this policy is deprecated.
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
|
||||
@ -31,59 +31,59 @@ Here’s an example to set AssignedAccess configuration:
|
||||
3. In the command prompt launched by psexec.exe, enter `powershell.exe` to open PowerShell.
|
||||
4. Execute the following script:
|
||||
|
||||
```ps
|
||||
```xml
|
||||
$nameSpaceName="root\cimv2\mdm\dmmap"
|
||||
$className="MDM_AssignedAccess"
|
||||
$obj = Get-CimInstance -Namespace $namespaceName -ClassName $className
|
||||
$obj.Configuration = @"
|
||||
<?xml version="1.0" encoding="utf-8" ?>
|
||||
<AssignedAccessConfiguration xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config">
|
||||
<Profiles>
|
||||
<Profile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}">
|
||||
<AllAppsList>
|
||||
<AllowedApps>
|
||||
<App AppUserModelId="Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic" />
|
||||
<App AppUserModelId="Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo" />
|
||||
<App AppUserModelId="Microsoft.Windows.Photos_8wekyb3d8bbwe!App" />
|
||||
<App AppUserModelId="Microsoft.BingWeather_8wekyb3d8bbwe!App" />
|
||||
<App AppUserModelId="Microsoft.WindowsCalculator_8wekyb3d8bbwe!App" />
|
||||
<App DesktopAppPath="%windir%\system32\mspaint.exe" />
|
||||
<App DesktopAppPath="C:\Windows\System32\notepad.exe" />
|
||||
</AllowedApps>
|
||||
</AllAppsList>
|
||||
<StartLayout>
|
||||
<![CDATA[<LayoutModificationTemplate xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout" Version="1" xmlns="http://schemas.microsoft.com/Start/2014/LayoutModification">
|
||||
<LayoutOptions StartTileGroupCellWidth="6" />
|
||||
<DefaultLayoutOverride>
|
||||
<StartLayoutCollection>
|
||||
<defaultlayout:StartLayout GroupCellWidth="6">
|
||||
<start:Group Name="Group1">
|
||||
<start:Tile Size="4x4" Column="0" Row="0" AppUserModelID="Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic" />
|
||||
<start:Tile Size="2x2" Column="4" Row="2" AppUserModelID="Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo" />
|
||||
<start:Tile Size="2x2" Column="4" Row="0" AppUserModelID="Microsoft.Windows.Photos_8wekyb3d8bbwe!App" />
|
||||
<start:Tile Size="2x2" Column="4" Row="4" AppUserModelID="Microsoft.BingWeather_8wekyb3d8bbwe!App" />
|
||||
<start:Tile Size="4x2" Column="0" Row="4" AppUserModelID="Microsoft.WindowsCalculator_8wekyb3d8bbwe!App" />
|
||||
</start:Group>
|
||||
<start:Group Name="Group2">
|
||||
<start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Accessories\Paint.lnk" />
|
||||
<start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Notepad.lnk" />
|
||||
</start:Group>
|
||||
</defaultlayout:StartLayout>
|
||||
</StartLayoutCollection>
|
||||
</DefaultLayoutOverride>
|
||||
</LayoutModificationTemplate>
|
||||
]]>
|
||||
</StartLayout>
|
||||
<Taskbar ShowTaskbar="true"/>
|
||||
</Profile>
|
||||
</Profiles>
|
||||
<Configs>
|
||||
<Config>
|
||||
<Account>MultiAppKioskUser</Account>
|
||||
<DefaultProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"/>
|
||||
</Config>
|
||||
</Configs>
|
||||
</AssignedAccessConfiguration>
|
||||
<?xml version="1.0" encoding="utf-8" ?>
|
||||
<AssignedAccessConfiguration xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config">
|
||||
<Profiles>
|
||||
<Profile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}">
|
||||
<AllAppsList>
|
||||
<AllowedApps>
|
||||
<App AppUserModelId="Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic" />
|
||||
<App AppUserModelId="Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo" />
|
||||
<App AppUserModelId="Microsoft.Windows.Photos_8wekyb3d8bbwe!App" />
|
||||
<App AppUserModelId="Microsoft.BingWeather_8wekyb3d8bbwe!App" />
|
||||
<App AppUserModelId="Microsoft.WindowsCalculator_8wekyb3d8bbwe!App" />
|
||||
<App DesktopAppPath="%windir%\system32\mspaint.exe" />
|
||||
<App DesktopAppPath="C:\Windows\System32\notepad.exe" />
|
||||
</AllowedApps>
|
||||
</AllAppsList>
|
||||
<StartLayout>
|
||||
<![CDATA[<LayoutModificationTemplate xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout" Version="1" xmlns="http://schemas.microsoft.com/Start/2014/LayoutModification">
|
||||
<LayoutOptions StartTileGroupCellWidth="6" />
|
||||
<DefaultLayoutOverride>
|
||||
<StartLayoutCollection>
|
||||
<defaultlayout:StartLayout GroupCellWidth="6">
|
||||
<start:Group Name="Group1">
|
||||
<start:Tile Size="4x4" Column="0" Row="0" AppUserModelID="Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic" />
|
||||
<start:Tile Size="2x2" Column="4" Row="2" AppUserModelID="Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo" />
|
||||
<start:Tile Size="2x2" Column="4" Row="0" AppUserModelID="Microsoft.Windows.Photos_8wekyb3d8bbwe!App" />
|
||||
<start:Tile Size="2x2" Column="4" Row="4" AppUserModelID="Microsoft.BingWeather_8wekyb3d8bbwe!App" />
|
||||
<start:Tile Size="4x2" Column="0" Row="4" AppUserModelID="Microsoft.WindowsCalculator_8wekyb3d8bbwe!App" />
|
||||
</start:Group>
|
||||
<start:Group Name="Group2">
|
||||
<start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Accessories\Paint.lnk" />
|
||||
<start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Notepad.lnk" />
|
||||
</start:Group>
|
||||
</defaultlayout:StartLayout>
|
||||
</StartLayoutCollection>
|
||||
</DefaultLayoutOverride>
|
||||
</LayoutModificationTemplate>
|
||||
]]>
|
||||
</StartLayout>
|
||||
<Taskbar ShowTaskbar="true"/>
|
||||
</Profile>
|
||||
</Profiles>
|
||||
<Configs>
|
||||
<Config>
|
||||
<Account>MultiAppKioskUser</Account>
|
||||
<DefaultProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"/>
|
||||
</Config>
|
||||
</Configs>
|
||||
</AssignedAccessConfiguration>
|
||||
"@
|
||||
|
||||
Set-CimInstance -CimInstance $obj
|
||||
|
||||
@ -31,7 +31,7 @@ The standard installation of UE-V synchronizes the default Microsoft Windows and
|
||||
|
||||
- [Step 2: Deploy the settings storage location](#step-2-deploy-the-settings-storage-location). Explains how to deploy a settings storage location. All UE-V deployments require a location to store settings packages that contain the synchronized setting values.
|
||||
|
||||
- [Step 3: Enable and configure the UE-V service](#step-3-enable-the-ue-v-service-on-user-devices). Explains how to enable to UE-V service on user devices and configure the storage path. To synchronize settings using UE-V, devices must have the UE-V service enabled and running.
|
||||
- [Step 3: Enable and configure the UE-V service](#step-3-enable-and-configure-the-ue-v-service-on-user-devices). Explains how to enable to UE-V service on user devices and configure the storage path. To synchronize settings using UE-V, devices must have the UE-V service enabled and running.
|
||||
|
||||
- [Step 4: Test Your UE-V evaluation deployment](#step-4-test-your-ue-v-evaluation-deployment). Run a few tests on two computers with the UE-V service enabled to see how UE-V works and if it meets your organization’s needs.
|
||||
|
||||
|
||||
@ -15,5 +15,4 @@ manager: dansimp
|
||||
|
||||
# HotSpot (Windows Configuration Designer reference)
|
||||
|
||||
Do not use. Enterprise admins who want to configure settings for mobile hotspots should use [Policies > Wifi](#wcd-policies.md#wifi). Mobile operators should use the [Country and Operator Settings Asset (COSA) format](https://docs.microsoft.com/windows-hardware/drivers/mobilebroadband/cosa-overview).
|
||||
|
||||
Do not use. Enterprise admins who want to configure settings for mobile hotspots should use [Policies > Wifi](wcd-policies.md#wifi). Mobile operators should use the [Country and Operator Settings Asset (COSA) format](https://docs.microsoft.com/windows-hardware/drivers/mobilebroadband/cosa-overview).
|
||||
@ -29,7 +29,7 @@ Devices and shared workstations that are online and available 24 hours a day, 7
|
||||
|
||||
You can use Configuration Manager to deploy feature updates to Windows 10 devices in two ways. The first option is to use the software updates feature. The second option is to use a task sequence to deploy feature updates. There are times when deploying a Windows 10 feature update requires the use of a task sequence—for example:
|
||||
|
||||
- **LTSC feature updates.** With the LTSC servicing branch, feature updates are never provided to the Windows clients themselves. Instead, feature updates must be installed like a traditional in-place upgrade.
|
||||
- **Upgrade to the next LTSC release.** With the LTSC servicing branch, feature updates are never provided to the Windows clients themselves. Instead, feature updates must be installed like a traditional in-place upgrade.
|
||||
- **Additional required tasks.** When deploying a feature update requires additional steps (e.g., suspending disk encryption, updating applications), you can use task sequences to orchestrate the additional steps. Software updates do not have the ability to add steps to their deployments.
|
||||
- **Language pack installs.** When deploying a feature update requires the installation of additional language packs, you can use task sequences to orchestrate the installation. Software updates do not have the ability to natively install language packs.
|
||||
|
||||
|
||||
@ -145,7 +145,7 @@ See [Deploy Windows 10 Enterprise licenses](deploy-enterprise-licenses.md).
|
||||
|
||||
## Deploy Windows 10 Enterprise features
|
||||
|
||||
Now that you have Windows 10 Enterprise edition running on devices, how do you take advantage of the Enterprise edition features and capabilities? What are the next steps that need to be taken for each of the features discussed in [Table 1](#compare-windows-10-pro-and-enterprise-editions)?
|
||||
Now that you have Windows 10 Enterprise edition running on devices, how do you take advantage of the Enterprise edition features and capabilities? What are the next steps that need to be taken for each of the features discussed in [Table 1](#compare-windows10-pro-and-enterprise-editions)?
|
||||
|
||||
The following sections provide you with the high-level tasks that need to be performed in your environment to help users take advantage of the Windows 10 Enterprise edition features.
|
||||
|
||||
|
||||
@ -117,6 +117,74 @@ When enabling the Guest account, only grant limited rights and permissions. For
|
||||
|
||||
In addition, the guest user in the Guest account should not be able to view the event logs. After the Guest account is enabled, it is a best practice to monitor the Guest account frequently to ensure that other users cannot use services and other resources, such as resources that were unintentionally left available by a previous user.
|
||||
|
||||
## <a href="" id="sec-helpassistant"></a>HelpAssistant account (installed with a Remote Assistance session)
|
||||
|
||||
|
||||
The HelpAssistant account is a default local account that is enabled when a Remote Assistance session is run. This account is automatically disabled when no Remote Assistance requests are pending.
|
||||
|
||||
HelpAssistant is the primary account that is used to establish a Remote Assistance session. The Remote Assistance session is used to connect to another computer running the Windows operating system, and it is initiated by invitation. For solicited remote assistance, a user sends an invitation from their computer, through e-mail or as a file, to a person who can provide assistance. After the user’s invitation for a Remote Assistance session is accepted, the default HelpAssistant account is automatically created to give the person who provides assistance limited access to the computer. The HelpAssistant account is managed by the Remote Desktop Help Session Manager service.
|
||||
|
||||
**Security considerations**
|
||||
|
||||
The SIDs that pertain to the default HelpAssistant account include:
|
||||
|
||||
- SID: S-1-5-<domain>-13, display name Terminal Server User. This group includes all users who sign in to a server with Remote Desktop Services enabled. Note that, in Windows Server 2008, Remote Desktop Services are called Terminal Services.
|
||||
|
||||
- SID: S-1-5-<domain>-14, display name Remote Interactive Logon. This group includes all users who connect to the computer by using a remote desktop connection. This group is a subset of the Interactive group. Access tokens that contain the Remote Interactive Logon SID also contain the Interactive SID.
|
||||
|
||||
For the Windows Server operating system, Remote Assistance is an optional component that is not installed by default. You must install Remote Assistance before it can be used.
|
||||
|
||||
For details about the HelpAssistant account attributes, see the following table.
|
||||
|
||||
**HelpAssistant account attributes**
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="50%" />
|
||||
<col width="50%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Attribute</th>
|
||||
<th>Value</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>Well-Known SID/RID</p></td>
|
||||
<td><p>S-1-5-<domain>-13 (Terminal Server User), S-1-5-<domain>-14 (Remote Interactive Logon)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
<td><p>User</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Default container</p></td>
|
||||
<td><p>CN=Users, DC=<domain>, DC=</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Default members</p></td>
|
||||
<td><p>None</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Default member of</p></td>
|
||||
<td><p>Domain Guests</p>
|
||||
<p>Guests</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Protected by ADMINSDHOLDER?</p></td>
|
||||
<td><p>No</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Safe to move out of default container?</p></td>
|
||||
<td><p>Can be moved out, but we do not recommend it.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Safe to delegate management of this group to non-Service admins?</p></td>
|
||||
<td><p>No</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
### DefaultAccount
|
||||
|
||||
|
||||
@ -83,7 +83,7 @@ The special identity groups are described in the following tables:
|
||||
|
||||
- [This Organization](#this-organization)
|
||||
|
||||
- [Window Manager\\Window Manager Group](#window-manager-window-manager-group)
|
||||
- [Window Manager\\Window Manager Group](#window-managerwindow-manager-group)
|
||||
|
||||
## Anonymous Logon
|
||||
|
||||
|
||||
@ -151,7 +151,7 @@ Sign-in a domain controller or management workstation with _Domain Admin_ equiva
|
||||
|
||||
### Windows Server 2012 or later Domain Controllers
|
||||
|
||||
Use the following procedures to configure AD FS when your environment uses **Windows Server 2012 or later Domain Controllers**. If you are not using Windows Server 2012 or later Domain Controllers, follow the procedures under the [Configure the Active Directory Federation Service Role (Windows Server 2008 or 2008R2 Domain Controllers)](#windows-server-2008-or-2008R2-domain-controllers) section.
|
||||
Use the following procedures to configure AD FS when your environment uses **Windows Server 2012 or later Domain Controllers**. If you are not using Windows Server 2012 or later Domain Controllers, follow the procedures under the [Configure the Active Directory Federation Service Role (Windows Server 2008 or 2008R2 Domain Controllers)](#windows-server-2008-or-2008-r2-domain-controllers) section.
|
||||
|
||||
Sign-in the federation server with _domain administrator_ equivalent credentials. These procedures assume you are configuring the first federation server in a federation server farm.
|
||||
|
||||
|
||||
@ -27,9 +27,6 @@ Device Registration is a prerequisite to Windows Hello for Business provisioning
|
||||
[Hybrid Azure AD joined in Managed environments](#hybrid-azure-ad-joined-in-managed-environments)<br>
|
||||
[Hybrid Azure AD joined in Federated environments](#hybrid-azure-ad-joined-in-federated-environments)<br>
|
||||
|
||||
|
||||
|
||||
|
||||
## Azure AD joined in Managed environments
|
||||
|
||||
|
||||
@ -44,7 +41,7 @@ Device Registration is a prerequisite to Windows Hello for Business provisioning
|
||||
|G | The application sends a device registration request to Azure DRS that includes the ID token, certificate request, tkpub, and attestation data. Azure DRS validates the ID token, creates a device ID, and creates a certificate based on the included certificate request. Azure DRS then writes a device object in Azure Active Directory and sends the device ID and the device certificate to the client.|
|
||||
|H | Device registration completes by receiving the device ID and the device certificate from Azure DRS. The device ID is saved for future reference (viewable from dsregcmd.exe /status), and the device certificate is installed in the Personal store of the computer. With device registration complete, the process continues with MDM enrollment.|
|
||||
|
||||
[Return to top](#Windows-Hello-for-Business-and-Device-Registration)
|
||||
[Return to top](#windows-hello-for-business-and-device-registration)
|
||||
## Azure AD joined in Federated environments
|
||||
|
||||
|
||||
@ -60,7 +57,7 @@ Device Registration is a prerequisite to Windows Hello for Business provisioning
|
||||
|H | The application sends a device registration request to Azure DRS that includes the ID token, certificate request, tkpub, and attestation data. Azure DRS validates the ID token, creates a device ID, and creates a certificate based on the included certificate request. Azure DRS then writes a device object in Azure Active Directory and sends the device ID and the device certificate to the client.|
|
||||
|I | Device registration completes by receiving the device ID and the device certificate from Azure DRS. The device ID is saved for future reference (viewable from dsregcmd.exe /status), and the device certificate is installed in the Personal store of the computer. With device registration complete, the process continues with MDM enrollment.|
|
||||
|
||||
[Return to top](#Windows-Hello-for-Business-and-Device-Registration)
|
||||
[Return to top](#windows-hello-for-business-and-device-registration)
|
||||
## Hybrid Azure AD joined in Managed environments
|
||||
|
||||
|
||||
@ -75,7 +72,7 @@ Device Registration is a prerequisite to Windows Hello for Business provisioning
|
||||
|G | The task sends a device registration request to Azure DRS that includes the ID token, certificate request, tkpub, and attestation data. Azure DRS validates the ID token, creates a device ID, and creates a certificate based on the included certificate request. Azure DRS then updates the device object in Azure Active Directory and sends the device ID and the device certificate to the client.|
|
||||
|H | Device registration completes by receiving the device ID and the device certificate from Azure DRS. The device ID is saved for future reference (viewable from dsregcmd.exe /status), and the device certificate is installed in the Personal store of the computer. With device registration complete, the task exits.|
|
||||
|
||||
[Return to top](#Windows-Hello-for-Business-and-Device-Registration)
|
||||
[Return to top](#windows-hello-for-business-and-device-registration)
|
||||
## Hybrid Azure AD joined in Federated environments
|
||||
|
||||
|
||||
@ -89,4 +86,4 @@ Device Registration is a prerequisite to Windows Hello for Business provisioning
|
||||
|F | The task sends a device registration request to Azure DRS that includes the ID token, certificate request, tkpub, and attestation data. Azure DRS validates the ID token, creates a device ID, and creates a certificate based on the included certificate request. Azure DRS then writes a device object in Azure Active Directory and sends the device ID and the device certificate to the client. Device registration completes by receiving the device ID and the device certificate from Azure DRS. The device ID is saved for future reference (viewable from dsregcmd.exe /status), and the device certificate is installed in the Personal store of the computer. With device registration complete, the task exits.|
|
||||
|G | If Azure AD Connect device write-back is enabled, Azure AD Connect requests updates from Azure Active Directory at its next synchronization cycle (device write-back is required for hybrid deployment using certificate trust). Azure Active Directory correlates the device object with a matching synchronized computer object. Azure AD Connect receives the device object that includes the object GUID and computer SID and writes the device object to Active Directory.|
|
||||
|
||||
[Return to top](#Windows-Hello-for-Business-and-Device-Registration)
|
||||
[Return to top](#windows-hello-for-business-and-device-registration)
|
||||
|
||||
@ -22,9 +22,9 @@ ms.reviewer:
|
||||
- Windows 10
|
||||
|
||||
Windows Hello for Business authentication works through collection of components and infrastructure working together. You can group the infrastructure and components in three categories:
|
||||
- [Registration](#Registration)
|
||||
- [Provisioning](#Provisioning)
|
||||
- [Authentication](#Authentication)
|
||||
- [Registration](#registration)
|
||||
- [Provisioning](#provisioning)
|
||||
- [Authentication](#authentication)
|
||||
|
||||
## Registration
|
||||
|
||||
|
||||
@ -90,7 +90,7 @@ Steps you will perform include:
|
||||
|
||||
- [Configure Internet Information Services to host CRL distribution point](#configure-internet-information-services-to-host-crl-distribution-point)
|
||||
- [Prepare a file share to host the certificate revocation list](#prepare-a-file-share-to-host-the-certificate-revocation-list)
|
||||
- [Configure the new CRL distribution point in the issuing certificate authority](#Configure-the-new-crl-distribution-point-in-the-issuing-certificate-authority)
|
||||
- [Configure the new CRL distribution point and Publishing location in the issuing certificate authority](#configure-the-new-crl-distribution-point-and-publishing-location-in-the-issuing-certificate-authority)
|
||||
- [Publish CRL](#publish-a-new-crl)
|
||||
- [Reissue domain controller certificates](#reissue-domain-controller-certificates)
|
||||
|
||||
|
||||
@ -29,14 +29,14 @@ Windows Hello for Business involves configuring distributed technologies that ma
|
||||
* [Active Directory](#active-directory)
|
||||
* [Public Key Infrastructure](#public-key-infrastructure)
|
||||
* [Azure Active Directory](#azure-active-directory)
|
||||
* [Active Directory Federation Services](#active-directory-federation-services)
|
||||
* [Multifactor Authentication Services](#multifactor-authentication-services)
|
||||
|
||||
|
||||
New installations are considerably more involved than existing implementations because you are building the entire infrastructure. Microsoft recommends you review the new installation baseline to validate your existing environment has all the needed configurations to support your hybrid certificate trust Windows Hello for Business deployment. If your environment meets these needs, you can read the [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md) section to prepare your Windows Hello for Business deployment by configuring directory synchronization.
|
||||
|
||||
The new installation baseline begins with a basic Active Directory deployment and enterprise PKI.
|
||||
|
||||
## Active Directory ##
|
||||
## Active Directory
|
||||
This document expects you have Active Directory deployed with an _adequate_ number of Windows Server 2016 domain controllers for each site. Read the [Planning an adequate number of Windows Server 2016 Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) to learn more.
|
||||
|
||||
Lab environments and isolated proof of concepts may want to limit the number of domain controllers. The purpose of these environments is to experiment and learn. Reducing the number of domain controllers can prevent troubleshooting issue, such as Active Directory replication, which is unrelated to activity's goal.
|
||||
@ -83,7 +83,7 @@ If you do not have an existing public key infrastructure, please review [Certifi
|
||||
> * Install the root certificate authority certificate for your organization in the user's trusted root certificate store.
|
||||
> * Publish your certificate revocation list to a location that is available to Azure AD joined devices, such as a web-based URL.
|
||||
|
||||
### Section Review ###
|
||||
### Section Review
|
||||
|
||||
> [!div class="checklist"]
|
||||
> * Minimum Windows Server 2012 Certificate Authority.
|
||||
@ -92,7 +92,7 @@ If you do not have an existing public key infrastructure, please review [Certifi
|
||||
> * Root certificate authority certificate (Azure AD Joined devices).
|
||||
> * Highly available certificate revocation list (Azure AD Joined devices).
|
||||
|
||||
## Azure Active Directory ##
|
||||
## Azure Active Directory
|
||||
You’ve prepared your Active Directory. Hybrid Windows Hello for Business deployment needs Azure Active Directory to host your cloud-based identities.
|
||||
|
||||
The next step of the deployment is to follow the [Creating an Azure AD tenant](https://docs.microsoft.com/azure/active-directory/develop/active-directory-howto-tenant) process to provision an Azure tenant for your organization.
|
||||
@ -104,12 +104,13 @@ The next step of the deployment is to follow the [Creating an Azure AD tenant](h
|
||||
> * Create an Azure Active Directory Tenant.
|
||||
> * Purchase the appropriate Azure Active Directory subscription or licenses, if necessary.
|
||||
|
||||
## Multifactor Authentication Services ##
|
||||
## Multifactor Authentication Services
|
||||
Windows Hello for Business uses multifactor authentication during provisioning and during user initiated PIN reset scenarios, such as when a user forgets their PIN. There are two preferred multifactor authentication configurations with hybrid deployments—Azure MFA and AD FS using Azure MFA or a third-party MFA adapter
|
||||
|
||||
Review the [What is Azure Multi-Factor Authentication](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication) topic to familiarize yourself its purpose and how it works.
|
||||
|
||||
### Azure Multi-Factor Authentication (MFA) Cloud ###
|
||||
### Azure Multi-Factor Authentication (MFA) Cloud
|
||||
|
||||
> [!IMPORTANT]
|
||||
> As long as your users have licenses that include Azure Multi-Factor Authentication, there's nothing that you need to do to turn on Azure MFA. You can start requiring two-step verification on an individual user basis. The licenses that enable Azure MFA are:
|
||||
> * Azure Multi-Factor Authentication
|
||||
@ -118,16 +119,16 @@ Review the [What is Azure Multi-Factor Authentication](https://docs.microsoft.co
|
||||
>
|
||||
> If you have one of these subscriptions or licenses, skip the Azure MFA Adapter section.
|
||||
|
||||
#### Azure MFA Provider ####
|
||||
#### Azure MFA Provider
|
||||
If your organization uses Azure MFA on a per-consumption model (no licenses), then review the [Create a Multifactor Authentication Provider](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-auth-provider) section to create an Azure MFA Authentication provider and associate it with your Azure tenant.
|
||||
|
||||
#### Configure Azure MFA Settings ####
|
||||
#### Configure Azure MFA Settings
|
||||
Once you have created your Azure MFA authentication provider and associated it with an Azure tenant, you need to configure the multi-factor authentication settings. Review the [Configure Azure Multi-Factor Authentication settings](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-whats-next) section to configure your settings.
|
||||
|
||||
#### Azure MFA User States ####
|
||||
#### Azure MFA User States
|
||||
After you have completed configuring your Azure MFA settings, you want to review configure [User States](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-user-states) to understand user states. User states determine how you enable Azure MFA for your users.
|
||||
|
||||
### Azure MFA via ADFS ###
|
||||
### Azure MFA via ADFS
|
||||
Alternatively, you can configure Windows Server 2016 Active Directory Federation Services (AD FS) to provide additional multi-factor authentication. To configure, read the [Configure AD FS 2016 and Azure MFA](https://docs.microsoft.com/windows-server/identity/ad-fs/operations/configure-ad-fs-2016-and-azure-mfa) section.
|
||||
|
||||
### Section Review
|
||||
|
||||
@ -28,13 +28,14 @@ Hybrid environments are distributed systems that enable organizations to use on-
|
||||
|
||||
The distributed systems on which these technologies were built involved several pieces of on-premises and cloud infrastructure. High-level pieces of the infrastructure include:
|
||||
* [Directories](#directories)
|
||||
* [Public Key Infrastructure](#public-key-infastructure)
|
||||
* [Public Key Infrastructure](#public-key-infrastructure)
|
||||
* [Directory Synchronization](#directory-synchronization)
|
||||
* [Federation](#federation)
|
||||
* [Federation](#federation-with-azure)
|
||||
* [MultiFactor Authentication](#multifactor-authentication)
|
||||
* [Device Registration](#device-registration)
|
||||
|
||||
## Directories ##
|
||||
## Directories
|
||||
|
||||
Hybrid Windows Hello for Business needs two directories: on-premises Active Directory and a cloud Azure Active Directory. The minimum required domain functional and forest functional levels for Windows Hello for Business deployment is Windows Server 2008 R2.
|
||||
|
||||
A hybrid Windows Hello for Business deployment needs an Azure Active Directory subscription. The hybrid key trust deployment, does not need a premium Azure Active Directory subscription.
|
||||
@ -43,7 +44,7 @@ You can deploy Windows Hello for Business in any environment with Windows Server
|
||||
|
||||
Review these requirements and those from the Windows Hello for Business planning guide and worksheet. Based on your deployment decisions you may need to upgrade your on-premises Active Directory or your Azure Active Directory subscription to meet your needs.
|
||||
|
||||
### Section Review ###
|
||||
### Section Review
|
||||
|
||||
> [!div class="checklist"]
|
||||
> * Active Directory Domain Functional Level
|
||||
@ -54,7 +55,7 @@ Review these requirements and those from the Windows Hello for Business planning
|
||||
|
||||
<br>
|
||||
|
||||
## Public Key Infrastructure ##
|
||||
## Public Key Infrastructure
|
||||
The Windows Hello for Business deployment depends on an enterprise public key infrastructure as trust anchor for authentication. Domain controllers for hybrid deployments need a certificate in order for Windows 10 devices to trust the domain controller.
|
||||
|
||||
Key trust deployments do not need client issued certificates for on-premises authentication. Active Directory user accounts are automatically configured for public key mapping by Azure AD Connect synchronizing the public key of the registered Windows Hello for Business credential to an attribute on the user's Active Directory object.
|
||||
@ -83,7 +84,8 @@ The minimum required enterprise certificate authority that can be used with Wind
|
||||
|
||||
<br>
|
||||
|
||||
## Directory Synchronization ##
|
||||
## Directory Synchronization
|
||||
|
||||
The two directories used in hybrid deployments must be synchronized. You need Azure Active Directory Connect to synchronize user accounts in the on-premises Active Directory with Azure Active Directory.
|
||||
|
||||
Organizations using older directory synchronization technology, such as DirSync or Azure AD sync need to upgrade to Azure AD Connect.
|
||||
@ -96,17 +98,20 @@ Organizations using older directory synchronization technology, such as DirSync
|
||||
|
||||
<br>
|
||||
|
||||
## Federation with Azure ##
|
||||
## Federation with Azure
|
||||
|
||||
You can deploy Windows Hello for Business key trust in non-federated and federated environments. For non-federated environments, key trust deployments work in environments that have deployed [Password Synchronization with Azure AD Connect](https://docs.microsoft.com/en-us/azure/active-directory/hybrid/whatis-phs) and [Azure Active Directory Pass-through-Authentication](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect-pass-through-authentication). For federated environments, you can deploy Windows Hello for Business key trust using Active Directory Federation Services (AD FS) beginning with Windows Server 2012 R2.
|
||||
|
||||
### Section Review ###
|
||||
### Section Review
|
||||
|
||||
> [!div class="checklist"]
|
||||
> * Non-federated environments
|
||||
> * Federated environments
|
||||
|
||||
<br>
|
||||
|
||||
## Multifactor Authentication ##
|
||||
## Multifactor Authentication
|
||||
|
||||
Windows Hello for Business is a strong, two-factor credential the helps organizations reduce their dependency on passwords. The provisioning process lets a user enroll in Windows Hello for Business using their user name and password as one factor, but needs a second factor of authentication.
|
||||
|
||||
Hybrid Windows Hello for Business deployments can use Azure’s Multifactor Authentication (MFA) service or they can use multifactor authentication provided by AD FS beginning with Windows Server 2012 R2, which includes an adapter model that enables third parties to integrate their MFA into AD FS. The MFA enabled by an Office 365 license is sufficient for Azure AD.
|
||||
@ -119,17 +124,20 @@ Hybrid Windows Hello for Business deployments can use Azure’s Multifactor Auth
|
||||
|
||||
<br>
|
||||
|
||||
## Device Registration ##
|
||||
## Device Registration
|
||||
|
||||
Organizations wanting to deploy hybrid key trust need their domain joined devices to register to Azure Active Directory. Just as a computer has an identity in Active Directory, that same computer has an identity in the cloud. This ensures that only approved computers are used with that Azure Active Directory. Each computer registers its identity in Azure Active Directory.
|
||||
|
||||
|
||||
### Section Checklist ###
|
||||
### Section Checklist
|
||||
|
||||
> [!div class="checklist"]
|
||||
> * Device Registration with Azure Device Registration
|
||||
|
||||
<br>
|
||||
|
||||
### Next Steps ###
|
||||
### Next Steps
|
||||
|
||||
Follow the Windows Hello for Business hybrid key trust deployment guide. For proof-of-concepts, labs, and new installations, choose the **New Installation Baseline**.
|
||||
|
||||
For environments transitioning from on-premises to hybrid, start with **Configure Azure Directory Synchronization**.
|
||||
|
||||
@ -150,7 +150,7 @@ Sign-in a domain controller or management workstation with _Domain Admin_ equiva
|
||||
|
||||
### Windows Server 2016, 2012 R2 or later Domain Controllers
|
||||
|
||||
Use the following procedures to configure AD FS when your environment uses **Windows Server 2012 or later Domain Controllers**. If you are not using Windows Server 2012 or later Domain Controllers, follow the procedures under the [Configure the Active Directory Federation Service Role (Windows Server 2008 or 2008R2 Domain Controllers)](#windows-server-2008-or-2008R2-domain-controllers) section.
|
||||
Use the following procedures to configure AD FS when your environment uses **Windows Server 2012 or later Domain Controllers**. If you are not using Windows Server 2012 or later Domain Controllers, follow the procedures under the [Configure the Active Directory Federation Service Role (Windows Server 2008 or 2008R2 Domain Controllers)](#windows-server-2008-or-2008-r2-domain-controllers) section.
|
||||
|
||||
Sign-in the federation server with _Domain Admin_ equivalent credentials. These procedures assume you are configuring the first federation server in a federation server farm.
|
||||
1. Start **Server Manager**.
|
||||
|
||||
@ -174,7 +174,7 @@ Update the server using Windows Update until the server has no required or optio
|
||||
|
||||
#### Configure the IIS Server’s Certificate
|
||||
|
||||
To do this, please follow the instructions mentioned in the previous [Configure the IIS Server’s Certificate](#configure-the-iis-server’s-certificate) section.
|
||||
To do this, please follow the instructions mentioned in the previous [Configure the IIS Server’s Certificate](#configure-the-iis-servers-certificate) section.
|
||||
|
||||
#### Create WebServices SDK user account
|
||||
|
||||
|
||||
@ -192,7 +192,7 @@ Control Flow Guard (CFG) is a mitigation that does not need configuration within
|
||||
| **Heap protections**<br>help prevent<br>exploitation of the heap | Windows 10 includes protections for the heap, such as the use of internal data structures which help protect against corruption of memory used by the heap.<br><br>**More information**: [Windows heap protections](#windows-heap-protections), later in this topic. |
|
||||
| **Kernel pool protections**<br>help prevent<br>exploitation of pool memory<br>used by the kernel | Windows 10 includes protections for the pool of memory used by the kernel. For example, safe unlinking protects against pool overruns that are combined with unlinking operations that can be used to create an attack.<br><br>**More information**: [Kernel pool protections](#kernel-pool-protections), later in this topic. |
|
||||
| **Control Flow Guard**<br>helps mitigate exploits<br>that are based on<br>flow between code locations<br>in memory | Control Flow Guard (CFG) is a mitigation that requires no configuration within the operating system, but instead is built into software when it’s compiled. It is built into Microsoft Edge, IE11, and other areas in Windows 10. CFG can be built into applications written in C or C++, or applications compiled using Visual Studio 2015.<br>For such an application, CFG can detect an attacker’s attempt to change the intended flow of code. If this occurs, CFG terminates the application. You can request software vendors to deliver Windows applications compiled with CFG enabled.<br><br>**More information**: [Control Flow Guard](#control-flow-guard), later in this topic. |
|
||||
| **Protections built into Microsoft Edge** (the browser)<br>helps mitigate multiple<br>threats | Windows 10 includes an entirely new browser, Microsoft Edge, designed with multiple security improvements.<br><br>**More information**: [Microsoft Edge and Internet Explorer 11](#microsoft-edge-and-internet-explorer-11), later in this topic. |
|
||||
| **Protections built into Microsoft Edge** (the browser)<br>helps mitigate multiple<br>threats | Windows 10 includes an entirely new browser, Microsoft Edge, designed with multiple security improvements.<br><br>**More information**: [Microsoft Edge and Internet Explorer 11](#microsoft-edge-and-internet-explorer11), later in this topic. |
|
||||
|
||||
### SMB hardening improvements for SYSVOL and NETLOGON shares
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 05/03/2018
|
||||
|
||||
Running Appication Control in audit mode allows administrators to discover any applications that were missed during an initial policy scan and to identify any new applications that have been installed and run since the original policy was created. While a WDAC policy is running in audit mode, any binary that runs and would have been denied had the policy been enforced is logged in the **Applications and Services Logs\\Microsoft\\Windows\\CodeIntegrity\\Operational** event log. When these logged binaries have been validated, they can easily be added to a new WDAC policy. When the new exception policy is created, you can merge it with your existing WDAC policies.
|
||||
|
||||
Before you begin this process, you need to create a WDAC policy binary file. If you have not already done so, see [Create an initial Windows Defender Application Control policy from a reference computer](#create-initial-default-policy).
|
||||
Before you begin this process, you need to create a WDAC policy binary file. If you have not already done so, see [Create an initial Windows Defender Application Control policy from a reference computer](create-initial-default-policy.md).
|
||||
|
||||
**To audit a Windows Defender Application Control policy with local policy:**
|
||||
|
||||
@ -94,7 +94,7 @@ Use the following procedure after you have been running a computer with a WDAC p
|
||||
|
||||
- Any applications that actually should not be allowed to run in your environment. Edit these out of the .xml file. If they remain in the .xml file, and the information in the file is merged into your existing WDAC policy, the policy will treat the applications as trusted, and allow them to run.
|
||||
|
||||
You can now use this file to update the existing WDAC policy that you ran in audit mode by merging the two policies. For instructions on how to merge this audit policy with the existing WDAC policy, see the next section, [Merge Windows Defender Application Control policies](#merge-windows-defender-application-control-policies).
|
||||
You can now use this file to update the existing WDAC policy that you ran in audit mode by merging the two policies. For instructions on how to merge this audit policy with the existing WDAC policy, see the next section, [Merge Windows Defender Application Control policies](merge-windows-defender-application-control-policies.md).
|
||||
|
||||
> [!NOTE]
|
||||
> You may have noticed that you did not generate a binary version of this policy as you did in [Create a Windows Defender Application Control policy from a reference computer](#create-a-windows-defender-application-control-policy-from-a-reference-computer). This is because WDAC policies created from an audit log are not intended to run as stand-alone policies but rather to update existing WDAC policies.
|
||||
> You may have noticed that you did not generate a binary version of this policy as you did in [Create a Windows Defender Application Control policy from a reference computer](create-initial-default-policy.md). This is because WDAC policies created from an audit log are not intended to run as stand-alone policies but rather to update existing WDAC policies.
|
||||
|
||||
@ -22,13 +22,17 @@ manager: dansimp
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
>[!IMPORTANT]
|
||||
>Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
|
||||
|
||||
Attack surface reduction rules help prevent behaviors malware often uses to infect computers with malicious code. You can set attack surface reduction rules for computers running Windows 10, version 1709 or later, Windows Server 2016 1803 or later, or Windows Server 2019.
|
||||
|
||||
Attack surface reduction rules help prevent behaviors malware often uses to infect computers with malicious code. You can set attack surface reduction rules for computers running Windows 10, versions 1704 and 1709 or later, Windows Server 2016 1803 or later, or Windows Server 2019.
|
||||
|
||||
|
||||
To use attack surface reduction rules, you need a Windows 10 Enterprise license. If you have a Windows E5 license, it gives you the advanced management capabilities to power them. These include monitoring, analytics, and workflows available in [Microsoft Defender Advanced Threat Protection](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md), as well as reporting and configuration capabilities in the Microsoft 365 Security Center. These advanced capabilities aren't available with an E3 license or with Windows 10 Enterprise without subscription, but you can use attack surface reduction rule events in Event Viewer to help facilitate deployment.
|
||||
|
||||
|
||||
Attack surface reduction rules target behaviors that malware and malicious apps typically use to infect computers, including:
|
||||
|
||||
- Executable files and scripts used in Office apps or web mail that attempt to download or run files
|
||||
@ -63,6 +67,8 @@ Event ID | Description
|
||||
1121 | Event when rule fires in Block-mode
|
||||
1122 | Event when rule fires in Audit-mode
|
||||
|
||||
The "engine version" of attack surface reduction events in the event log, is generated by Microsoft Defender ATP, not the operating system. Microsoft Defender ATP is integrated with Windows 10, so this feature works on all machines with Windows 10 installed.
|
||||
|
||||
|
||||
## Attack surface reduction rules
|
||||
|
||||
@ -207,7 +213,7 @@ GUID: c1db55ab-c21a-4637-bb3f-a12568109d35
|
||||
|
||||
### Block credential stealing from the Windows local security authority subsystem (lsass.exe)
|
||||
|
||||
Local Security Authority Subsystem Service (LSASS) authenticates users who log in to a Windows computer. Windows Defender Credential Guard in Windows 10 normally prevents attempts to extract credentials from LSASS. However, some organizations can't enable Credential Guard on all of their computers because of compatibility issues with custom smartcard drivers or other programs that load into the Local Security Authority (LSA). In these cases, attackers can use tools like Mimikatz to scrape cleartext passwords and NTLM hashes from LSASS. This rule helps mitigate that risk by locking down LSASS.
|
||||
Local Security Authority Subsystem Service (LSASS) authenticates users who log in to a Windows computer. Microsoft Defender Credential Guard in Windows 10 normally prevents attempts to extract credentials from LSASS. However, some organizations can't enable Credential Guard on all of their computers because of compatibility issues with custom smartcard drivers or other programs that load into the Local Security Authority (LSA). In these cases, attackers can use tools like Mimikatz to scrape cleartext passwords and NTLM hashes from LSASS. This rule helps mitigate that risk by locking down LSASS.
|
||||
|
||||
>[!NOTE]
|
||||
>In some apps, the code enumerates all running processes and attempts to open them with exhaustive permissions. This rule denies the app's process open action and logs the details to the security event log. This rule can generate a lot of noise. If you have an app that overly enumerates LSASS, you need to add it to the exclusion list. By itself, this event log entry doesn't necessarily indicate a malicious threat.
|
||||
@ -284,3 +290,5 @@ GUID: e6db77e5-3df2-4cf1-b95a-636979351e5b
|
||||
|
||||
- [Enable attack surface reduction rules](enable-attack-surface-reduction.md)
|
||||
- [Evaluate attack surface reduction rules](evaluate-attack-surface-reduction.md)
|
||||
- [Compatibility of Microsoft Defender with other antivirus/antimalware](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility)
|
||||
|
||||
|
||||
@ -29,10 +29,6 @@ To configure Windows Defender Firewall with Advanced Security to log dropped pac
|
||||
|
||||
To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs.
|
||||
|
||||
In this topic:
|
||||
|
||||
- [To configure the Windows Defender Firewall with Advanced Security log](#to-configure-the-windows-firewall-log)
|
||||
|
||||
## To configure the Windows Defender Firewall with Advanced Security log
|
||||
|
||||
1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md).
|
||||
|
||||
@ -29,12 +29,6 @@ This procedure shows you how to open the Windows Defender Firewall with Advanced
|
||||
|
||||
To complete this procedure, you must be a member of the Administrators group. For more information, see Additional considerations.
|
||||
|
||||
## Opening Windows Defender Firewall
|
||||
|
||||
- [Using the Windows interface](#to-open-windows-firewall-with-advanced-security-using-the-ui)
|
||||
|
||||
- [Using a command line](#to-open-windows-firewall-with-advanced-security-from-a-command-prompt)
|
||||
|
||||
## To open Windows Defender Firewall using the UI
|
||||
|
||||
Click Start, type **Windows Defender Firewall**, and the press ENTER.
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user