From 9a6d5036c376632cbbaaf8889c03f03272ee53f6 Mon Sep 17 00:00:00 2001
From: ImranHabib <47118050+joinimran@users.noreply.github.com>
Date: Fri, 22 Feb 2019 20:03:26 +0500
Subject: [PATCH 01/33] DG Readiness command was old

A new version that is 3.6 has been released and because of this, the command DG Readiness command should be updated. I have checked the module and found that the new version of DCG is 3.6 and PowerShell command has been updated to DG_Readiness_Tool_v3.6.ps1 -Disable -AutoReboot
---
 .../credential-guard/credential-guard-manage.md                 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/windows/security/identity-protection/credential-guard/credential-guard-manage.md b/windows/security/identity-protection/credential-guard/credential-guard-manage.md
index def101e7d1..3ab59e7851 100644
--- a/windows/security/identity-protection/credential-guard/credential-guard-manage.md
+++ b/windows/security/identity-protection/credential-guard/credential-guard-manage.md
@@ -191,7 +191,7 @@ For more info on virtualization-based security and Windows Defender Device Guard
 You can also disable Windows Defender Credential Guard by using the [Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool](https://www.microsoft.com/download/details.aspx?id=53337).
 
 ```
-DG_Readiness_Tool_v3.5.ps1 -Disable -AutoReboot
+DG_Readiness_Tool_v3.6.ps1 -Disable -AutoReboot
 ```
 
 #### Disable Windows Defender Credential Guard for a virtual machine

From 0afbbaf3c52da4c4d748bc19653291cf49194a6c Mon Sep 17 00:00:00 2001
From: Zane <34351912+zburtondbrs@users.noreply.github.com>
Date: Fri, 22 Feb 2019 12:41:52 -0500
Subject: [PATCH 02/33] Update uev-getting-started.md

typo in GPO name
---
 windows/configuration/ue-v/uev-getting-started.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/windows/configuration/ue-v/uev-getting-started.md b/windows/configuration/ue-v/uev-getting-started.md
index de3fecb42b..a4a8ead75e 100644
--- a/windows/configuration/ue-v/uev-getting-started.md
+++ b/windows/configuration/ue-v/uev-getting-started.md
@@ -110,7 +110,7 @@ With Windows 10, version 1607 and later, the UE-V service is installed on user d
 
 2.  Navigate to **Computer Configuration** &gt; **Administrative Templates** &gt; **Windows Components** &gt; **Microsoft** **User Experience Virtualization**.
 
-3.  Double click **Use Users Experience Virtualization (UE-V)**.
+3.  Double click **Use User Experience Virtualization (UE-V)**.
 
 4.  Select **Enabled** and click **OK**.
 

From 1012bc2d8115503486674c22e5acd298a63eaed4 Mon Sep 17 00:00:00 2001
From: Geoff <34522990+GeoffFromMSFT@users.noreply.github.com>
Date: Fri, 22 Feb 2019 13:08:56 -0800
Subject: [PATCH 03/33] Update policy-csp-devicelock.md

---
 windows/client-management/mdm/policy-csp-devicelock.md | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/windows/client-management/mdm/policy-csp-devicelock.md b/windows/client-management/mdm/policy-csp-devicelock.md
index e258974ff4..4d766ec5f7 100644
--- a/windows/client-management/mdm/policy-csp-devicelock.md
+++ b/windows/client-management/mdm/policy-csp-devicelock.md
@@ -724,7 +724,10 @@ The following list shows the supported values:
 
 <!--/Scope-->
 <!--Description-->
-Specifies the maximum amount of time (in minutes) allowed after the device is idle that will cause the device to become PIN or password locked. Users can select any existing timeout value less than the specified maximum time in the Settings app. Note the Lumia 950 and 950XL have a maximum timeout value of 5 minutes, regardless of the value set by this policy.
+Specifies the maximum amount of time (in minutes) allowed after the device is idle that will cause the device to become PIN or password locked. Users can select any existing timeout value less than the specified maximum time in the Settings app.
+
+* On Mobile, the Lumia 950 and 950XL have a maximum timeout value of 5 minutes, regardless of the value set by this policy.
+* On HoloLens, this timeout is controlled by the device's system sleep timeout, regardless of the value set by this policy.
 
 > [!NOTE]
 > This policy must be wrapped in an Atomic command.

From 16592c9cf1afdcb91a4ad18dfd7df480fa646727 Mon Sep 17 00:00:00 2001
From: illfated <illfated@users.noreply.github.com>
Date: Sun, 24 Feb 2019 00:52:50 +0100
Subject: [PATCH 04/33] Client Management/MDM: repair broken links in
 oma-dm-protocol-support.md

Links to the OMA website containing OMA Device Management documents
have been broken for some time now, due to OMA website rearrangements.

This is an attempt to restore the links to the OMA website as much as possible,
given the existing references, to the documents or their directory containers.

Thanks to vlad-MSFT for providing the initial link to the website folder structure.

Closes #2759
Closes #2362
---
 .../client-management/mdm/oma-dm-protocol-support.md | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/windows/client-management/mdm/oma-dm-protocol-support.md b/windows/client-management/mdm/oma-dm-protocol-support.md
index c0369b83bb..b01d17d7d2 100644
--- a/windows/client-management/mdm/oma-dm-protocol-support.md
+++ b/windows/client-management/mdm/oma-dm-protocol-support.md
@@ -13,7 +13,7 @@ ms.date: 06/26/2017
 
 # OMA DM protocol support
 
-The OMA DM client communicates with the server over HTTPS and uses DM Sync (OMA DM v1.2) as the message payload. This topic describes the OMA DM functionality that the DM client supports in general. The full description of the OMA DM protocol v1.2 can be found at the [OMA website](https://go.microsoft.com/fwlink/p/?LinkId=267526).
+The OMA DM client communicates with the server over HTTPS and uses DM Sync (OMA DM v1.2) as the message payload. This topic describes the OMA DM functionality that the DM client supports in general. The full description of the OMA DM protocol v1.2 can be found at the [OMA website](http://www.openmobilealliance.org/release/DM/V1_2-20070209-A/OMA-TS-DM_Protocol-V1_2-20070209-A.pdf).
 
 
 ## In this topic
@@ -62,7 +62,7 @@ The following table shows the OMA DM standards that Windows uses.
 </tr>
 <tr class="odd">
 <td style="vertical-align:top"><p>DM protocol commands</p></td>
-<td style="vertical-align:top"><p>The following list shows the commands that are used by the device. For further information about the OMA DM command elements, see &quot;SyncML Representation Protocol Device Management Usage (OMA-SyncML-DMRepPro-V1_1_2-20030613-A)&quot; available from the [OMA website](https://go.microsoft.com/fwlink/p/?LinkId=267526).</p>
+<td style="vertical-align:top"><p>The following list shows the commands that are used by the device. For further information about the OMA DM command elements, see &quot;SyncML Representation Protocol Device Management Usage (OMA-SyncML-DMRepPro-V1_1_2-20030613-A)&quot; available from the [OMA website](http://www.openmobilealliance.org/release/DM/V1_1_2-20031209-A/).</p>
 <ul>
 <li><p>Add (Implicit Add supported)</p></li>
 <li><p>Alert (DM alert): Generic alert (1226) is used by enterprise management client when the user triggers an MDM unenrollment action from the device or when a CSP finishes some asynchronous actions. Device alert (1224) is used to notify the server some device triggered event.</p></li>
@@ -146,7 +146,7 @@ The following table shows the OMA DM standards that Windows uses.
 <a href="" id="protocol-common-elements"></a>
 ## OMA DM protocol common elements
 
-Common elements are used by other OMA DM element types. The following table lists the OMA DM common elements used to configure the devices. For more information about OMA DM common elements, see "SyncML Representation Protocol Device Management Usage" (OMA-SyncML-DMRepPro-V1\_1\_2-20030613-A) available from the [OMA website](https://go.microsoft.com/fwlink/p/?LinkId=526900).
+Common elements are used by other OMA DM element types. The following table lists the OMA DM common elements used to configure the devices. For more information about OMA DM common elements, see "SyncML Representation Protocol Device Management Usage" (OMA-SyncML-DMRepPro-V1_1_2-20030613-A) available from the [OMA website](http://www.openmobilealliance.org/release/DM/V1_1_2-20031209-A/).
 
 <table>
 <colgroup>
@@ -301,15 +301,15 @@ The following table shows the sequence of events during a typical DM session.
 </tbody>
 </table>
 
- 
 
-The step numbers in the table do not represent message identification numbers (MsgID). All messages from the server must have a MsgID that is unique within the session, starting at 1 for the first message, and increasing by an increment of 1 for each additional message. For more information about MsgID and OMA SyncML protocol, see "OMA Device Management Representation Protocol" (OMA-TS-DM\_RepPro-V1\_2-20070209-A) available from the [OMA website](https://go.microsoft.com/fwlink/p/?LinkId=526900).
+
+The step numbers in the table do not represent message identification numbers (MsgID). All messages from the server must have a MsgID that is unique within the session, starting at 1 for the first message, and increasing by an increment of 1 for each additional message. For more information about MsgID and OMA SyncML protocol, see "OMA Device Management Representation Protocol" (DM_RepPro-V1_2-20070209-A) available from the [OMA website](http://www.openmobilealliance.org/release/DM/V1_2-20070209-A/).
 
 During OMA DM application level mutual authentication, if the device response code to Cred element in the server request is 212, no further authentication is needed for the remainder of the DM session. In the case of the MD5 authentication, the Chal element can be returned. Then the next nonce in Chal must be used for the MD5 digest when the next DM session is started.
 
 If a request includes credentials and the response code to the request is 200, the same credential must be sent within the next request. If the Chal element is included and the MD5 authentication is required, a new digest is created by using the next nonce via the Chal element for next request.
 
-For more information about Basic or MD5 client authentication, MD5 server authentication, MD5 hash, and MD5 nonce, see the OMA Device Management Security specification (OMA-TS-DM\_Security-V1\_2\_1-20080617-A), authentication response code handling and step-by-step samples in OMA Device Management Protocol specification (OMA-TS-DM\_Protocol-V1\_2\_1-20080617-A), available from the [OMA website](https://go.microsoft.com/fwlink/p/?LinkId=526900).
+For more information about Basic or MD5 client authentication, MD5 server authentication, MD5 hash, and MD5 nonce, see the OMA Device Management Security specification (OMA-TS-DM_Security-V1_2_1-20080617-A), authentication response code handling and step-by-step samples in OMA Device Management Protocol specification (OMA-TS-DM_Protocol-V1_2_1-20080617-A), available from the [OMA website](http://www.openmobilealliance.org/release/DM/V1_2_1-20080617-A/).
 
 
 ## User targeted vs. Device targeted configuration

From 0ac4c1c9d2aedeb8d1c91e1943fd37df55cfc435 Mon Sep 17 00:00:00 2001
From: Jeremiah Cox <17728431+out0xb2@users.noreply.github.com>
Date: Mon, 25 Feb 2019 09:03:55 -0800
Subject: [PATCH 05/33] Updated per partner feedback

---
 windows/client-management/mdm/uefi-csp.md | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/windows/client-management/mdm/uefi-csp.md b/windows/client-management/mdm/uefi-csp.md
index f434251f74..2a3373702b 100644
--- a/windows/client-management/mdm/uefi-csp.md
+++ b/windows/client-management/mdm/uefi-csp.md
@@ -17,6 +17,9 @@ The UEFI configuration service provider (CSP) interfaces to UEFI's Device Firmwa
 > [!Note]  
 > The UEFI CSP version published in Windows 10, version 1803 is replaced with this one (version 1809).
 
+> [!Note]  
+> The production UEFI CSP is present in 1809, but it depends upon the Devicie Firmware Configuration Interface (DFCI) and UEFI firmware the complies with this interface.  The specification for this interface and compatible firmware is not yet available.
+
 The following diagram shows the UEFI CSP in tree format.
 
 ![Uefi CSP diagram](images/provisioning-csp-uefi.png)
@@ -124,4 +127,4 @@ Value type is Base64. Supported operation is Replace.
 <a href="" id="settings2-result"></a>**Settings2/Result**  
 Retrieves the binary result package of previous Settings2/Apply operation. This binary package contains XML describing the action taken for each individual setting.
 
-Supported operation is Get.
\ No newline at end of file
+Supported operation is Get.

From dd9bb94113b7827872b04153fd7464476e0b0c03 Mon Sep 17 00:00:00 2001
From: Deland Han <delhan@microsoft.com>
Date: Tue, 26 Feb 2019 14:07:25 +0800
Subject: [PATCH 06/33] update

---
 windows/security/threat-protection/auditing/event-4769.md | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/windows/security/threat-protection/auditing/event-4769.md b/windows/security/threat-protection/auditing/event-4769.md
index cfb61706ce..465a4bd51a 100644
--- a/windows/security/threat-protection/auditing/event-4769.md
+++ b/windows/security/threat-protection/auditing/event-4769.md
@@ -80,12 +80,14 @@ You will typically see many Failure events with **Failure Code** “**0x20**”,
 
 **Account Information:**
 
--   **Account Name** \[Type = UnicodeString\]**:** the User Principal Name (UPN) of the account that requested the ticket. Computer account name ends with **$** character in UPN. This field typically has the following value format: user\_account\_name@FULL\_DOMAIN\_NAME.
+-   **Account Name** \[Type = UnicodeString\]**:** the user name of the account that requested the ticket in the User Principal Name (UPN) syntax. Computer account name ends with **$** character in the user name part. This field typically has the following value format: user\_account\_name@FULL\_DOMAIN\_NAME.
 
     -   User account example: dadmin@CONTOSO.LOCAL
 
     -   Computer account example: WIN81$@CONTOSO.LOCAL
 
+        > **Note** Although this field is in the UPN format, this is not the attribute value of "UserPrincipalName" of the user account. It is the "normalized" name or implicit UPN. It is built from the user SamAccountName and the Active Directory domain name.
+
         This parameter in this event is optional and can be empty in some cases.
 
 -   **Account Domain** \[Type = UnicodeString\]**:** the name of the Kerberos Realm that **Account Name** belongs to. This can appear in a variety of formats, including the following:
@@ -100,7 +102,7 @@ You will typically see many Failure events with **Failure Code** “**0x20**”,
 
 -   **Logon GUID** \[Type = GUID\]: a GUID that can help you correlate this event (on a domain controller) with other events (on the target computer for which the TGS was issued) that can contain the same **Logon GUID**. These events are “[4624](event-4624.md): An account was successfully logged on”, “[4648](event-4648.md)(S): A logon was attempted using explicit credentials” and “[4964](event-4964.md)(S): Special groups have been assigned to a new logon.”
 
-    This parameter might not be captured in the event, and in that case appears as “{00000000-0000-0000-0000-000000000000}”.
+    This parameter might not be captured in the event, and in that case appears as "{00000000-0000-0000-0000-000000000000}".
 
 > **Note**&nbsp;&nbsp;**GUID** is an acronym for 'Globally Unique Identifier'. It is a 128-bit integer number used to identify resources, activities or instances.
 

From fac8fe376de488a0fa953e942e8219b2071fa301 Mon Sep 17 00:00:00 2001
From: Deland-Han <delhan@microsoft.com>
Date: Tue, 26 Feb 2019 14:09:17 +0800
Subject: [PATCH 07/33] update

---
 windows/security/threat-protection/auditing/event-4769.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/windows/security/threat-protection/auditing/event-4769.md b/windows/security/threat-protection/auditing/event-4769.md
index 465a4bd51a..b837812eea 100644
--- a/windows/security/threat-protection/auditing/event-4769.md
+++ b/windows/security/threat-protection/auditing/event-4769.md
@@ -171,7 +171,7 @@ The most common values:
 | 12    | Transited-policy-checked | KILE MUST NOT check for transited domains on servers or a KDC. Application servers MUST ignore the TRANSITED-POLICY-CHECKED flag.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
 | 13    | Ok-as-delegate           | The KDC MUST set the OK-AS-DELEGATE flag if the service account is trusted for delegation.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
 | 14    | Request-anonymous        | KILE not use this flag.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| 15    | Name-canonicalize        | In order to request referrals the Kerberos client MUST explicitly request the "canonicalize" KDC option for the AS-REQ or TGS-REQ.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| 15    | Name-canonicalize        | In order to request referrals the Kerberos client MUST explicitly request the “canonicalize” KDC option for the AS-REQ or TGS-REQ.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
 | 16-25 | Unused                   | -                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
 | 26    | Disable-transited-check  | By default the KDC will check the transited field of a TGT against the policy of the local realm before it will issue derivative tickets based on the TGT. If this flag is set in the request, checking of the transited field is disabled. Tickets issued without the performance of this check will be noted by the reset (0) value of the TRANSITED-POLICY-CHECKED flag, indicating to the application server that the transited field must be checked locally. KDCs are encouraged but not required to honor<br>the DISABLE-TRANSITED-CHECK option.<br>Should not be in use, because Transited-policy-checked flag is not supported by KILE. |
 | 27    | Renewable-ok             | The RENEWABLE-OK option indicates that a renewable ticket will be acceptable if a ticket with the requested life cannot otherwise be provided, in which case a renewable ticket may be issued with a renew-till equal to the requested end time. The value of the renew-till field may still be limited by local limits, or limits selected by the individual principal or server.                                                                                                                                                                                                                                                                           |

From a7c0ef000b57e0e322f25edce440fb9747c96364 Mon Sep 17 00:00:00 2001
From: Deland-Han <delhan@microsoft.com>
Date: Tue, 26 Feb 2019 14:13:08 +0800
Subject: [PATCH 08/33] typo

---
 windows/security/threat-protection/auditing/event-4769.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/windows/security/threat-protection/auditing/event-4769.md b/windows/security/threat-protection/auditing/event-4769.md
index b837812eea..ea200b936f 100644
--- a/windows/security/threat-protection/auditing/event-4769.md
+++ b/windows/security/threat-protection/auditing/event-4769.md
@@ -102,7 +102,7 @@ You will typically see many Failure events with **Failure Code** “**0x20**”,
 
 -   **Logon GUID** \[Type = GUID\]: a GUID that can help you correlate this event (on a domain controller) with other events (on the target computer for which the TGS was issued) that can contain the same **Logon GUID**. These events are “[4624](event-4624.md): An account was successfully logged on”, “[4648](event-4648.md)(S): A logon was attempted using explicit credentials” and “[4964](event-4964.md)(S): Special groups have been assigned to a new logon.”
 
-    This parameter might not be captured in the event, and in that case appears as "{00000000-0000-0000-0000-000000000000}".
+    This parameter might not be captured in the event, and in that case appears as “{00000000-0000-0000-0000-000000000000}”.
 
 > **Note**&nbsp;&nbsp;**GUID** is an acronym for 'Globally Unique Identifier'. It is a 128-bit integer number used to identify resources, activities or instances.
 

From b9b9391fb533f2d8506145ba01f7db328b3adbd8 Mon Sep 17 00:00:00 2001
From: Mohamed Kamal <mk_kamal@hotmail.com>
Date: Tue, 26 Feb 2019 12:31:08 +0200
Subject: [PATCH 09/33] add additional step to load PS Module

https://github.com/MicrosoftDocs/windows-itpro-docs/issues/2624
---
 ...a-package-created-in-a-previous-version-of-app-v.md | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/mdop/appv-v5/how-to-convert-a-package-created-in-a-previous-version-of-app-v.md b/mdop/appv-v5/how-to-convert-a-package-created-in-a-previous-version-of-app-v.md
index 3cb0a94237..7584b481fe 100644
--- a/mdop/appv-v5/how-to-convert-a-package-created-in-a-previous-version-of-app-v.md
+++ b/mdop/appv-v5/how-to-convert-a-package-created-in-a-previous-version-of-app-v.md
@@ -32,9 +32,15 @@ You must configure the package converter to always save the package ingredients
 
 **Getting started**
 
-1.  Install the App-V Sequencer on a computer in your environment. For information about how to install the Sequencer, see [How to Install the Sequencer](how-to-install-the-sequencer-beta-gb18030.md).
+1.  Install the App-V Sequencer on a computer in your environment . For information about how to install the Sequencer, see [How to Install the Sequencer](how-to-install-the-sequencer-beta-gb18030.md).   
 
-2.  
+2. Import the required Powershell Module
+
+```powershell
+Import-Module AppVPkgConverter
+'''
+
+3.  
 
     The following cmdlets are available:
 

From 03282d25663314da90577983b47cc8cf25a20754 Mon Sep 17 00:00:00 2001
From: Mohamed Kamal <mk_kamal@hotmail.com>
Date: Tue, 26 Feb 2019 12:32:14 +0200
Subject: [PATCH 10/33] Update
 how-to-convert-a-package-created-in-a-previous-version-of-app-v.md

---
 ...-convert-a-package-created-in-a-previous-version-of-app-v.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mdop/appv-v5/how-to-convert-a-package-created-in-a-previous-version-of-app-v.md b/mdop/appv-v5/how-to-convert-a-package-created-in-a-previous-version-of-app-v.md
index 7584b481fe..5abfd596f8 100644
--- a/mdop/appv-v5/how-to-convert-a-package-created-in-a-previous-version-of-app-v.md
+++ b/mdop/appv-v5/how-to-convert-a-package-created-in-a-previous-version-of-app-v.md
@@ -38,7 +38,7 @@ You must configure the package converter to always save the package ingredients
 
 ```powershell
 Import-Module AppVPkgConverter
-'''
+```
 
 3.  
 

From 0b2efe892e3134fd10abba1e779e783b99186603 Mon Sep 17 00:00:00 2001
From: James Birkinshaw <jambirk@microsoft.com>
Date: Tue, 26 Feb 2019 12:36:33 -0800
Subject: [PATCH 11/33] updated SfB server links to new docs home

---
 .../surface-hub/prepare-your-environment-for-surface-hub.md   | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/devices/surface-hub/prepare-your-environment-for-surface-hub.md b/devices/surface-hub/prepare-your-environment-for-surface-hub.md
index 0ae8b338d8..cfb912384d 100644
--- a/devices/surface-hub/prepare-your-environment-for-surface-hub.md
+++ b/devices/surface-hub/prepare-your-environment-for-surface-hub.md
@@ -37,8 +37,8 @@ Additionally, note that Surface Hub requires the following open ports:
 
 If you are using Surface Hub with Skype for Business, you will need to open additional ports. Please follow the guidance below:
 - If you use Skype for Business Online, see [Office 365 IP URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US).
-- If you use Skype for Business Server, see [Skype for Business Server: Ports and protocols for internal servers](https://technet.microsoft.com/library/gg398833.aspx). 
-- If you use a hybrid of Skype for Business Online and Skype for Business Server, you need to open all documented ports from [Office 365 IP URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US) and [Skype for Business Server: Ports and protocols for internal servers](https://technet.microsoft.com/library/gg398833.aspx).
+- If you use Skype for Business Server, see [Skype for Business Server: Ports and protocols for internal servers](https://docs.microsoft.com/SkypeForBusiness/plan-your-deployment/network-requirements/ports-and-protocols?toc=/SkypeForBusiness/toc.json&bc=/SkypeForBusiness/breadcrumb/toc.json). 
+- If you use a hybrid of Skype for Business Online and Skype for Business Server, you need to open all documented ports from [Office 365 IP URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US) and [Skype for Business Server: Ports and protocols for internal servers](https://docs.microsoft.com/en-us/SkypeForBusiness/plan-your-deployment/network-requirements/ports-and-protocols?toc=/SkypeForBusiness/toc.json&bc=/SkypeForBusiness/breadcrumb/toc.json).
 
 Microsoft collects diagnostic data to help improve your Surface Hub experience. Add these sites to your allow list:
 - Diagnostic data client endpoint: `https://vortex.data.microsoft.com/`

From 0db92cf55b65011ff5c686be063fa5e7dbfd01d2 Mon Sep 17 00:00:00 2001
From: Mohamed Kamal <mk_kamal@hotmail.com>
Date: Wed, 27 Feb 2019 07:45:49 +0200
Subject: [PATCH 12/33] Update
 how-to-convert-a-package-created-in-a-previous-version-of-app-v.md

---
 ...-convert-a-package-created-in-a-previous-version-of-app-v.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mdop/appv-v5/how-to-convert-a-package-created-in-a-previous-version-of-app-v.md b/mdop/appv-v5/how-to-convert-a-package-created-in-a-previous-version-of-app-v.md
index 5abfd596f8..a3969a0d7f 100644
--- a/mdop/appv-v5/how-to-convert-a-package-created-in-a-previous-version-of-app-v.md
+++ b/mdop/appv-v5/how-to-convert-a-package-created-in-a-previous-version-of-app-v.md
@@ -32,7 +32,7 @@ You must configure the package converter to always save the package ingredients
 
 **Getting started**
 
-1.  Install the App-V Sequencer on a computer in your environment . For information about how to install the Sequencer, see [How to Install the Sequencer](how-to-install-the-sequencer-beta-gb18030.md).   
+1.  Install the App-V Sequencer on a computer in your environment. For information about how to install the Sequencer, see [How to Install the Sequencer](how-to-install-the-sequencer-beta-gb18030.md).
 
 2. Import the required Powershell Module
 

From d5ee57f5d4724564adaf6f0a4e337601a6137cc7 Mon Sep 17 00:00:00 2001
From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com>
Date: Wed, 27 Feb 2019 09:22:30 -0800
Subject: [PATCH 13/33] Update
 devices/surface-hub/prepare-your-environment-for-surface-hub.md

Co-Authored-By: jambirk <jambirk@microsoft.com>
---
 devices/surface-hub/prepare-your-environment-for-surface-hub.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/devices/surface-hub/prepare-your-environment-for-surface-hub.md b/devices/surface-hub/prepare-your-environment-for-surface-hub.md
index cfb912384d..98d3cd4e4f 100644
--- a/devices/surface-hub/prepare-your-environment-for-surface-hub.md
+++ b/devices/surface-hub/prepare-your-environment-for-surface-hub.md
@@ -38,7 +38,7 @@ Additionally, note that Surface Hub requires the following open ports:
 If you are using Surface Hub with Skype for Business, you will need to open additional ports. Please follow the guidance below:
 - If you use Skype for Business Online, see [Office 365 IP URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US).
 - If you use Skype for Business Server, see [Skype for Business Server: Ports and protocols for internal servers](https://docs.microsoft.com/SkypeForBusiness/plan-your-deployment/network-requirements/ports-and-protocols?toc=/SkypeForBusiness/toc.json&bc=/SkypeForBusiness/breadcrumb/toc.json). 
-- If you use a hybrid of Skype for Business Online and Skype for Business Server, you need to open all documented ports from [Office 365 IP URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US) and [Skype for Business Server: Ports and protocols for internal servers](https://docs.microsoft.com/en-us/SkypeForBusiness/plan-your-deployment/network-requirements/ports-and-protocols?toc=/SkypeForBusiness/toc.json&bc=/SkypeForBusiness/breadcrumb/toc.json).
+- If you use a hybrid of Skype for Business Online and Skype for Business Server, you need to open all documented ports from [Office 365 IP URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US) and [Skype for Business Server: Ports and protocols for internal servers](https://docs.microsoft.com/SkypeForBusiness/plan-your-deployment/network-requirements/ports-and-protocols?toc=/SkypeForBusiness/toc.json&bc=/SkypeForBusiness/breadcrumb/toc.json).
 
 Microsoft collects diagnostic data to help improve your Surface Hub experience. Add these sites to your allow list:
 - Diagnostic data client endpoint: `https://vortex.data.microsoft.com/`

From b1b05855a29f197a205085a4775a7b697fb26465 Mon Sep 17 00:00:00 2001
From: illfated <illfated@users.noreply.github.com>
Date: Wed, 27 Feb 2019 21:18:04 +0100
Subject: [PATCH 14/33] Windows Defender Application Control/AppLocker: typo
 correction & remove blanks

- Correction: change "how to used" to read "how to use".
- Removal: remove 2 redundant blank lines at the end of the document.

Ref. #1230 (No data?)
---
 .../applocker/administer-applocker.md                         | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker.md
index ac2242bb9f..a00dd7cc28 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker.md
@@ -37,7 +37,7 @@ AppLocker helps administrators control how users can access and use files, such
 
 | Topic | Description |
 | - | - |
-| [Administer AppLocker using Mobile Device Management (MDM)](administer-applocker-using-mdm.md) | This topic describes how to used MDM to manage AppLocker policies. |
+| [Administer AppLocker using Mobile Device Management (MDM)](administer-applocker-using-mdm.md) | This topic describes how to use MDM to manage AppLocker policies. |
 | [Maintain AppLocker policies](maintain-applocker-policies.md) | This topic describes how to maintain rules within AppLocker policies. |
 | [Edit an AppLocker policy](edit-an-applocker-policy.md) | This topic for IT professionals describes the steps required to modify an AppLocker policy. |
 | [Test and update an AppLocker policy](test-and-update-an-applocker-policy.md) | This topic discusses the steps required to test an AppLocker policy prior to deployment. |
@@ -71,5 +71,3 @@ You must have Edit Setting permission to edit a GPO. By default, members of the
 ## Using Windows PowerShell to administer AppLocker
 
 For how-to info about administering AppLocker with Windows PowerShell, see [Use the AppLocker Windows PowerShell Cmdlets](use-the-applocker-windows-powershell-cmdlets.md). For reference info and examples how to administer AppLocker with Windows PowerShell, see the [AppLocker cmdlets](https://technet.microsoft.com/library/hh847210.aspx).
- 
- 

From 9a73b6e15537578ef4b7dd8d3164cec6c23de78c Mon Sep 17 00:00:00 2001
From: illfated <illfated@users.noreply.github.com>
Date: Wed, 27 Feb 2019 23:05:43 +0100
Subject: [PATCH 15/33] Wake On LAN for Surface devices: update supported
 devices list in wake-on-lan-for-surface-devices.md

Thanks to @Scottmca for providing the list and verifying this list with the product team.

Closes #2633
---
 .../wake-on-lan-for-surface-devices.md        | 21 ++++++++++++-------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/devices/surface/wake-on-lan-for-surface-devices.md b/devices/surface/wake-on-lan-for-surface-devices.md
index c584cc40bb..907ab49ce6 100644
--- a/devices/surface/wake-on-lan-for-surface-devices.md
+++ b/devices/surface/wake-on-lan-for-surface-devices.md
@@ -23,17 +23,22 @@ Surface devices that run Windows 10, version 1607 (also known as Windows 10 Anni
 
 The following devices are supported for WOL:
 
-* Surface Book 2
-* Surface Pro with LTE Advanced (Model 1807)
-* Surface Pro (Model 1796)
-* Surface Laptop
-* Surface Book
-* Surface Pro 4
-* Surface 3
-* Surface Pro 3
 * Surface Ethernet adapter
+* Surface USB-C to Ethernet and USB Adapter
 * Surface Dock
 * Surface Docking Station for Surface Pro 3
+* Surface 3
+* Surface Pro 3
+* Surface Pro 4
+* Surface Pro (5th Gen)
+* Surface Pro (5th Gen) with LTE Advanced
+* Surface Book
+* Surface Laptop (1st Gen)
+* Surface Pro 6
+* Surface Book 2
+* Surface Laptop 2
+* Surface Go
+* Surface Go with LTE Advanced
 
 ## WOL driver
 

From ec5960f9287f788fa796192c914b8beb68c5cf3e Mon Sep 17 00:00:00 2001
From: Aacer Daken <41165107+AaDake@users.noreply.github.com>
Date: Wed, 27 Feb 2019 14:32:31 -0800
Subject: [PATCH 16/33] Update kernel-dma-protection-for-thunderbolt.md

Updated FAQ to reflect the new name in Device manager properties, rather than the GUID previously used in build 1803 and 1809
---
 .../kernel-dma-protection-for-thunderbolt.md                  | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md b/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md
index 529d064913..2a25a68d5b 100644
--- a/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md
+++ b/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md
@@ -94,9 +94,11 @@ In-market systems, released with Windows 10 version 1709 or earlier, will not su
 No, Kernel DMA Protection only protects against drive-by DMA attacks after the OS is loaded. It is the responsibility of the system firmware/BIOS to protect against attacks via the Thunderbolt™ 3 ports during boot. 
 
 ### How can I check if a certain driver supports DMA-remapping?
-DMA-remapping is supported for specific device drivers, and is not universally supported by all devices and drivers on a platform. To check if a specific driver is opted into DMA-remapping, check the values corresponding to the following Property GUID (highlighted in red in the image below) in the Details tab of a device in Device Manager. A value of 0 or 1 means that the device driver does not support DMA-remapping. A value of 2 means that the device driver supports DMA-remapping.
+DMA-remapping is supported for specific device drivers, and is not universally supported by all devices and drivers on a platform. To check if a specific driver is opted into DMA-remapping, check the values corresponding to the DMA Remapping Policy property in the Details tab of a device in Device Manager*. A value of 0 or 1 means that the device driver does not support DMA-remapping. A value of 2 means that the device driver supports DMA-remapping.
 Please check the driver instance for the device you are testing. Some drivers may have varying values depending on the location of the device (internal vs. external).
 
+*For Windows 10 versions 1803 and 1809, the property field in Device Manager uses a GUID, as highlighted in the image below
+
 ![Kernel DMA protection user experience](images/device-details-tab.png)
 
 ### What should I do if the drivers for my Thunderbolt™ 3 peripherals do not support DMA-remapping?

From cb30e808da8b309c4b34a06e19ec7f355e720c31 Mon Sep 17 00:00:00 2001
From: przlplx <36421998+przlplx@users.noreply.github.com>
Date: Wed, 27 Feb 2019 15:47:03 -0800
Subject: [PATCH 17/33] Update create-wip-policy-using-intune-azure.md

---
 .../create-wip-policy-using-intune-azure.md                     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md
index e748a7ae20..ecfa80d4d0 100644
--- a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md
+++ b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md
@@ -416,7 +416,7 @@ There are no default locations included with WIP, you must add each of your netw
         <tr>
             <td>Cloud Resources</td>
             <td><strong>With proxy:</strong> contoso.sharepoint.com,contoso.internalproxy1.com|<br>contoso.visualstudio.com,contoso.internalproxy2.com<br><br><strong>Without proxy:</strong> contoso.sharepoint.com|contoso.visualstudio.com</td>
-            <td>Specify the cloud resources to be treated as corporate and protected by WIP.<br><br>For each cloud resource, you may also optionally specify a proxy server from your Internal proxy servers list to route traffic for this cloud resource. Be aware that all traffic routed through your Internal proxy servers is considered enterprise.<br><br>If you have multiple resources, you must separate them using the "|" delimiter. If you don’t use proxy servers, you must also include the "," delimiter just before the "|". For example: <code>URL &lt;,proxy&gt;|URL &lt;,proxy&gt;</code>.<br><br><strong>Important</strong><br>In some cases, such as when an app connects directly to a cloud resource through an IP address, Windows can’t tell whether it’s attempting to connect to an enterprise cloud resource or to a personal site. In this case, Windows blocks the connection by default. To stop Windows from automatically blocking these connections, you can add the <code>/&#42;AppCompat&#42;/</code> string to the setting. For example: <code>URL &lt;,proxy&gt;|URL &lt;,proxy&gt;|/&#42;AppCompat&#42;/</code>.<br><br>When using this string, we recommend that you also turn on [Azure Active Directory Conditional Access](https://docs.microsoft.com/azure/active-directory/active-directory-conditional-access), using the <strong>Domain joined or marked as compliant</strong> option, which blocks apps from accessing any enterprise cloud resources that are protected by conditional access.</td>
+            <td>Specify the cloud resources to be treated as corporate and protected by WIP.<br><br>For each cloud resource, you may also optionally specify a proxy server from your Internal proxy servers list to route traffic for this cloud resource. Be aware that all traffic routed through your Internal proxy servers is considered enterprise.<br><br>If you have multiple resources, you must separate them using the "|" delimiter. If you don’t use proxy servers, you must also include the "," delimiter just before the "|". For example: <code>URL &lt;,proxy&gt;|URL &lt;,proxy&gt;</code>.<br><br><strong>Important</strong><br>In some cases, such as when an app connects directly to a cloud resource through an IP address, Windows can’t tell whether it’s attempting to connect to an enterprise cloud resource or to a personal site. In this case, Windows blocks the connection by default. To stop Windows from automatically blocking these connections, you can add the <code>/&#42;AppCompat&#42;/</code> string to the setting. For example: <code>URL &lt;,proxy&gt;|URL &lt;,proxy&gt;|/&#42;AppCompat&#42;/</code><br><br><strong>Note</strong><br>To add subdomain for a cloud resource, use a period (.) instead of an asterisk (*). For example: To add all subdomains within Office.com, use ".office.com" (without the quotation marks).<br><br>When you use this string, we recommend that you also turn on [Azure Active Directory Conditional Access](https://docs.microsoft.com/azure/active-directory/active-directory-conditional-access) by using the <strong>Domain joined or marked as compliant</strong> option, which blocks apps from accessing any enterprise cloud resources that are protected by conditional access.</td>
         </tr>
         <tr>
             <td>Protected domains</td>

From a3d6a06eaebe9a46a92b77ebcdd4a1f48d7e5ea5 Mon Sep 17 00:00:00 2001
From: Harshitha Chidananda Murthy <harshithac94@gmail.com>
Date: Wed, 27 Feb 2019 17:07:57 -0800
Subject: [PATCH 18/33] Extending support range

---
 devices/surface/battery-limit.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/devices/surface/battery-limit.md b/devices/surface/battery-limit.md
index dce83705cc..95c6d544b9 100644
--- a/devices/surface/battery-limit.md
+++ b/devices/surface/battery-limit.md
@@ -19,7 +19,7 @@ Battery Limit option is a UEFI setting that changes how the Surface device batte
 
 Setting the device on Battery Limit changes the protocol for charging the device battery. When Battery Limit is enabled, the battery charge will be limited to 50% of its maximum capacity. The charge level reported in Windows will reflect this limit. Therefore, it will show that the battery is charged up to 50% and will not charge beyond  this limit. If you enable Battery Limit while the device is above 50% charge, the Battery icon will show that the device is plugged in but discharging until the device reaches 50% of its maximum charge capacity.  
 
-Adding the Battery Limit option to Surface UEFI will require a [Surface UEFI firmware update](update.md), which will be made available through Windows Update or via the MSI driver and firmware packages on the Microsoft Download Center. Check [Enable "Battery Limit" for Surface devices that have to be plugged in for extended periods of time](https://support.microsoft.com/help/4464941) for the specific Surface UEFI version required for each device and supported devices. Currently, Battery Limit is only supported on Surface Pro 4 and Surface Pro 3. However, the setting will be available in the future on other Surface device models. 
+Adding the Battery Limit option to Surface UEFI will require a [Surface UEFI firmware update](update.md), which will be made available through Windows Update or via the MSI driver and firmware packages on the Microsoft Download Center. Check [Enable "Battery Limit" for Surface devices that have to be plugged in for extended periods of time](https://support.microsoft.com/help/4464941) for the specific Surface UEFI version required for each device and supported devices. Currently, Battery Limit is only supported on some Surface devices as listed in [Battery Limit support page] (https://support.microsoft.com/help/4464941). However, the setting will be available in the future on other Surface device models. 
 
 ## Enabling Battery Limit in Surface UEFI (Surface Pro 4 and later)
 

From 45f6c86989ab64d10cf89604347ef55b0577269f Mon Sep 17 00:00:00 2001
From: Deland Han <delandmail@163.com>
Date: Thu, 28 Feb 2019 12:55:55 +0800
Subject: [PATCH 19/33] 98653

---
 .../start-layout-troubleshoot.md              | 27 +++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/windows/configuration/start-layout-troubleshoot.md b/windows/configuration/start-layout-troubleshoot.md
index 635ee7e17a..cb0103ffff 100644
--- a/windows/configuration/start-layout-troubleshoot.md
+++ b/windows/configuration/start-layout-troubleshoot.md
@@ -300,6 +300,33 @@ C:\Windows\System32\tdlrecover.exe -reregister -resetlayout -resetcache
 
 Although a reboot is not required, it may help clear up any residual issues after the command is run.
 
+### Symptoms: Start Menu and Apps cannot start after upgrade to Windows 10 version 1809 when Symantec Endpoint Protection is installed
+
+**Description** Start Menu, Search and Apps do not start after you upgrade a Windows 7-based computer that has Symantec Endpoint Protection installed to Windows 10 version 1809.
+
+**Cause** This occurs because of a failure to load sysfer.dll.  During upgrade, the setup process does not set the privilege group "All Application Packages" on sysfer.dll and other Symantec modules.
+
+**Resolution** This issue was fixed by the Windows Cumulative Update that were released on December 5, 2018—KB4469342 (OS Build 17763.168).
+
+If you have already encountered this issue, use one of the following two options to fix the issue:
+
+**Option 1** Remove sysfer.dll from system32 folder and copy it back. Windows will set privilege automatically.
+
+**Option 2** 
+
+1. Locate the directory C:\Windows\system32.
+
+2. Right-click on sysfer.dll and choose **Properties**.
+
+3. Switch to the **Security** tab.
+
+4. Confirm that **All Application Packages** group is missing.
+
+5. Click **Edit**, and then click **Add** to add the group.
+
+6. Test Start and other Apps.
+
+
 
 
 

From a4224f4f57294a4509f91fd059faaabee910243d Mon Sep 17 00:00:00 2001
From: Wes Keetch <wesk@microsoft.com>
Date: Thu, 28 Feb 2019 02:26:19 -0600
Subject: [PATCH 20/33] Update windows-10-upgrade-paths.md

Per discussion w/Greg Lindsey, I'm removing references to the Enterprise LTSC from the table.  For some reason I'm unable to remove Enterprise LTSC from the upper table...proposing this change and will try to edit and submit an additional PR.
---
 .../deployment/upgrade/windows-10-upgrade-paths.md   | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/windows/deployment/upgrade/windows-10-upgrade-paths.md b/windows/deployment/upgrade/windows-10-upgrade-paths.md
index 91d6394973..a1a57c4f21 100644
--- a/windows/deployment/upgrade/windows-10-upgrade-paths.md
+++ b/windows/deployment/upgrade/windows-10-upgrade-paths.md
@@ -42,7 +42,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
         <td>Windows 10 Pro Education</td>
         <td>Windows 10 Education</td>
         <td>Windows 10 Enterprise</td>
-        <td>Windows 10 Enterprise LTSC</td>
         <td>Windows 10 Mobile</td>
         <td>Windows 10 Mobile Enterprise</td>
     </tr>
@@ -264,17 +263,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
         <td></td>
         <td></td>
     </tr>
-    <tr>
-        <td>Enterprise LTSC</td>
-        <td></td>
-        <td></td>
-        <td></td>
-        <td></td>
-        <td>✔</td>
-        <td>✔</td>
-        <td></td>
-        <td></td>
-    </tr>
     <tr>
         <td>Mobile</td>
         <td></td>

From 3a897deba78a94fef0eec59646e6a5b01547d325 Mon Sep 17 00:00:00 2001
From: illfated <illfated@users.noreply.github.com>
Date: Thu, 28 Feb 2019 21:39:30 +0100
Subject: [PATCH 21/33] Use https: instead of http:

---
 .../client-management/mdm/oma-dm-protocol-support.md   | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/windows/client-management/mdm/oma-dm-protocol-support.md b/windows/client-management/mdm/oma-dm-protocol-support.md
index b01d17d7d2..29344603d2 100644
--- a/windows/client-management/mdm/oma-dm-protocol-support.md
+++ b/windows/client-management/mdm/oma-dm-protocol-support.md
@@ -13,7 +13,7 @@ ms.date: 06/26/2017
 
 # OMA DM protocol support
 
-The OMA DM client communicates with the server over HTTPS and uses DM Sync (OMA DM v1.2) as the message payload. This topic describes the OMA DM functionality that the DM client supports in general. The full description of the OMA DM protocol v1.2 can be found at the [OMA website](http://www.openmobilealliance.org/release/DM/V1_2-20070209-A/OMA-TS-DM_Protocol-V1_2-20070209-A.pdf).
+The OMA DM client communicates with the server over HTTPS and uses DM Sync (OMA DM v1.2) as the message payload. This topic describes the OMA DM functionality that the DM client supports in general. The full description of the OMA DM protocol v1.2 can be found at the [OMA website](https://www.openmobilealliance.org/release/DM/V1_2-20070209-A/OMA-TS-DM_Protocol-V1_2-20070209-A.pdf).
 
 
 ## In this topic
@@ -62,7 +62,7 @@ The following table shows the OMA DM standards that Windows uses.
 </tr>
 <tr class="odd">
 <td style="vertical-align:top"><p>DM protocol commands</p></td>
-<td style="vertical-align:top"><p>The following list shows the commands that are used by the device. For further information about the OMA DM command elements, see &quot;SyncML Representation Protocol Device Management Usage (OMA-SyncML-DMRepPro-V1_1_2-20030613-A)&quot; available from the [OMA website](http://www.openmobilealliance.org/release/DM/V1_1_2-20031209-A/).</p>
+<td style="vertical-align:top"><p>The following list shows the commands that are used by the device. For further information about the OMA DM command elements, see &quot;SyncML Representation Protocol Device Management Usage (OMA-SyncML-DMRepPro-V1_1_2-20030613-A)&quot; available from the [OMA website](https://www.openmobilealliance.org/release/DM/V1_1_2-20031209-A/).</p>
 <ul>
 <li><p>Add (Implicit Add supported)</p></li>
 <li><p>Alert (DM alert): Generic alert (1226) is used by enterprise management client when the user triggers an MDM unenrollment action from the device or when a CSP finishes some asynchronous actions. Device alert (1224) is used to notify the server some device triggered event.</p></li>
@@ -146,7 +146,7 @@ The following table shows the OMA DM standards that Windows uses.
 <a href="" id="protocol-common-elements"></a>
 ## OMA DM protocol common elements
 
-Common elements are used by other OMA DM element types. The following table lists the OMA DM common elements used to configure the devices. For more information about OMA DM common elements, see "SyncML Representation Protocol Device Management Usage" (OMA-SyncML-DMRepPro-V1_1_2-20030613-A) available from the [OMA website](http://www.openmobilealliance.org/release/DM/V1_1_2-20031209-A/).
+Common elements are used by other OMA DM element types. The following table lists the OMA DM common elements used to configure the devices. For more information about OMA DM common elements, see "SyncML Representation Protocol Device Management Usage" (OMA-SyncML-DMRepPro-V1_1_2-20030613-A) available from the [OMA website](https://www.openmobilealliance.org/release/DM/V1_1_2-20031209-A/).
 
 <table>
 <colgroup>
@@ -303,13 +303,13 @@ The following table shows the sequence of events during a typical DM session.
 
 
 
-The step numbers in the table do not represent message identification numbers (MsgID). All messages from the server must have a MsgID that is unique within the session, starting at 1 for the first message, and increasing by an increment of 1 for each additional message. For more information about MsgID and OMA SyncML protocol, see "OMA Device Management Representation Protocol" (DM_RepPro-V1_2-20070209-A) available from the [OMA website](http://www.openmobilealliance.org/release/DM/V1_2-20070209-A/).
+The step numbers in the table do not represent message identification numbers (MsgID). All messages from the server must have a MsgID that is unique within the session, starting at 1 for the first message, and increasing by an increment of 1 for each additional message. For more information about MsgID and OMA SyncML protocol, see "OMA Device Management Representation Protocol" (DM_RepPro-V1_2-20070209-A) available from the [OMA website](https://www.openmobilealliance.org/release/DM/V1_2-20070209-A/).
 
 During OMA DM application level mutual authentication, if the device response code to Cred element in the server request is 212, no further authentication is needed for the remainder of the DM session. In the case of the MD5 authentication, the Chal element can be returned. Then the next nonce in Chal must be used for the MD5 digest when the next DM session is started.
 
 If a request includes credentials and the response code to the request is 200, the same credential must be sent within the next request. If the Chal element is included and the MD5 authentication is required, a new digest is created by using the next nonce via the Chal element for next request.
 
-For more information about Basic or MD5 client authentication, MD5 server authentication, MD5 hash, and MD5 nonce, see the OMA Device Management Security specification (OMA-TS-DM_Security-V1_2_1-20080617-A), authentication response code handling and step-by-step samples in OMA Device Management Protocol specification (OMA-TS-DM_Protocol-V1_2_1-20080617-A), available from the [OMA website](http://www.openmobilealliance.org/release/DM/V1_2_1-20080617-A/).
+For more information about Basic or MD5 client authentication, MD5 server authentication, MD5 hash, and MD5 nonce, see the OMA Device Management Security specification (OMA-TS-DM_Security-V1_2_1-20080617-A), authentication response code handling and step-by-step samples in OMA Device Management Protocol specification (OMA-TS-DM_Protocol-V1_2_1-20080617-A), available from the [OMA website](https://www.openmobilealliance.org/release/DM/V1_2_1-20080617-A/).
 
 
 ## User targeted vs. Device targeted configuration

From 1a3fd790613f9bff78a45dcaf03be35bbf404888 Mon Sep 17 00:00:00 2001
From: Nicole Turner <39884432+nenonix@users.noreply.github.com>
Date: Thu, 28 Feb 2019 23:01:06 +0200
Subject: [PATCH 22/33] Update windows-10-enterprise-e3-overview.md

Edited line 18: added "and activated" to enhance clarity and removed "also known as" to keep sentence concise
As per https://github.com/MicrosoftDocs/windows-itpro-docs/issues/2723

(Also removed /en-us/ locale code from links on  lines 252 and 253 )
---
 windows/deployment/windows-10-enterprise-e3-overview.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/windows/deployment/windows-10-enterprise-e3-overview.md b/windows/deployment/windows-10-enterprise-e3-overview.md
index 950c8553a1..2838a773e0 100644
--- a/windows/deployment/windows-10-enterprise-e3-overview.md
+++ b/windows/deployment/windows-10-enterprise-e3-overview.md
@@ -15,7 +15,7 @@ author: greg-lindsay
 
 Windows 10 Enterprise E3 launched in the Cloud Solution Provider (CSP) channel on September 1, 2016. Windows 10 Enterprise E3 in CSP is a new offering that delivers, by subscription, exclusive features reserved for Windows 10 Enterprise edition. This offering is available through the Cloud Solution Provider (CSP) channel via the Partner Center as an online service. Windows 10 Enterprise E3 in CSP provides a flexible, per-user subscription for small- and medium-sized organizations (from one to hundreds of users). To take advantage of this offering, you must have the following:
 
--   Windows 10 Pro, version 1607 (also known as Windows 10 Anniversary Update) or later installed on the devices to be upgraded
+-   Windows 10 Pro, version 1607 (Windows 10 Anniversary Update) or later, installed and activated, on the devices to be upgraded
 -   Azure Active Directory (Azure AD) available for identity management
 
 Starting with Windows 10, version 1607 (Windows 10 Anniversary Update), you can move from Windows 10 Pro to Windows 10 Enterprise more easily than ever before—no keys and no reboots. After one of your users enters the Azure AD credentials associated with a Windows 10 Enterprise E3 license, the operating system turns from Windows 10 Pro to Windows 10 Enterprise and all the appropriate Windows 10 Enterprise features are unlocked. When a subscription license expires or is transferred to another user, the Windows 10 Enterprise device seamlessly steps back down to Windows 10 Pro.
@@ -249,5 +249,5 @@ The Managed User Experience feature is a set of Windows 10 Enterprise edition f
 
 [Windows 10 Enterprise Subscription Activation](windows-10-enterprise-subscription-activation.md)
 <BR>[Connect domain-joined devices to Azure AD for Windows 10 experiences](https://azure.microsoft.com/documentation/articles/active-directory-azureadjoin-devices-group-policy/)
-<BR>[Compare Windows 10 editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare)
-<BR>[Windows for business](https://www.microsoft.com/en-us/windowsforbusiness/default.aspx)
+<BR>[Compare Windows 10 editions](https://www.microsoft.com/WindowsForBusiness/Compare)
+<BR>[Windows for business](https://www.microsoft.com/windowsforbusiness/default.aspx)

From 2b9092d7eb5a21c64a63355f98b9ce9ffcbf63d7 Mon Sep 17 00:00:00 2001
From: illfated <illfated@users.noreply.github.com>
Date: Thu, 28 Feb 2019 22:59:38 +0100
Subject: [PATCH 23/33] Client Management/MDM: typo corrections & clarification
 in uefi-csp.md

- Typo corrections: "Devicie" -> Device (obvious typo) - and "the complies"
- Clarification: "the complies with this interface" -> "to comply with this interface"

Reasoning behind the clarification change: This is about the UEFI CSP depending upon the
Device Firmware Configuration Interface (DFCI) and UEFI firmware to be compliant,
not as I first thought in PR #2770, that it would depend on which DFCI/UEFI is being used.

Ref. #2770 (as above)
---
 windows/client-management/mdm/uefi-csp.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/windows/client-management/mdm/uefi-csp.md b/windows/client-management/mdm/uefi-csp.md
index 2a3373702b..85542e6932 100644
--- a/windows/client-management/mdm/uefi-csp.md
+++ b/windows/client-management/mdm/uefi-csp.md
@@ -18,7 +18,7 @@ The UEFI configuration service provider (CSP) interfaces to UEFI's Device Firmwa
 > The UEFI CSP version published in Windows 10, version 1803 is replaced with this one (version 1809).
 
 > [!Note]  
-> The production UEFI CSP is present in 1809, but it depends upon the Devicie Firmware Configuration Interface (DFCI) and UEFI firmware the complies with this interface.  The specification for this interface and compatible firmware is not yet available.
+> The production UEFI CSP is present in 1809, but it depends upon the Device Firmware Configuration Interface (DFCI) and UEFI firmware to comply with this interface.  The specification for this interface and compatible firmware is not yet available.
 
 The following diagram shows the UEFI CSP in tree format.
 

From 79d7c3ff7e6f31eab6ff83371c8a6552c0d74197 Mon Sep 17 00:00:00 2001
From: Harshitha Chidananda Murthy <harshithac94@gmail.com>
Date: Thu, 28 Feb 2019 19:01:40 -0800
Subject: [PATCH 24/33] Minor edits based on marketing review

---
 devices/surface/battery-limit.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/devices/surface/battery-limit.md b/devices/surface/battery-limit.md
index 95c6d544b9..cd61a7ad8d 100644
--- a/devices/surface/battery-limit.md
+++ b/devices/surface/battery-limit.md
@@ -19,7 +19,7 @@ Battery Limit option is a UEFI setting that changes how the Surface device batte
 
 Setting the device on Battery Limit changes the protocol for charging the device battery. When Battery Limit is enabled, the battery charge will be limited to 50% of its maximum capacity. The charge level reported in Windows will reflect this limit. Therefore, it will show that the battery is charged up to 50% and will not charge beyond  this limit. If you enable Battery Limit while the device is above 50% charge, the Battery icon will show that the device is plugged in but discharging until the device reaches 50% of its maximum charge capacity.  
 
-Adding the Battery Limit option to Surface UEFI will require a [Surface UEFI firmware update](update.md), which will be made available through Windows Update or via the MSI driver and firmware packages on the Microsoft Download Center. Check [Enable "Battery Limit" for Surface devices that have to be plugged in for extended periods of time](https://support.microsoft.com/help/4464941) for the specific Surface UEFI version required for each device and supported devices. Currently, Battery Limit is only supported on some Surface devices as listed in [Battery Limit support page] (https://support.microsoft.com/help/4464941). However, the setting will be available in the future on other Surface device models. 
+Adding the Battery Limit option to Surface UEFI requires a [Surface UEFI firmware update](update.md), available through Windows Update or via the MSI driver and firmware packages on the Microsoft Download Center. Check [Enable "Battery Limit" for Surface devices that have to be plugged in for extended periods of time](https://support.microsoft.com/help/4464941) for the specific Surface UEFI version required for each supported device . Currently, Battery Limit is supported on a subset of Surface devices and will be available in the future on other Surface device models. 
 
 ## Enabling Battery Limit in Surface UEFI (Surface Pro 4 and later)
 

From cfd368fc5e0e9d079b2b6d6cbb832da84d6d41ea Mon Sep 17 00:00:00 2001
From: Joseph Hopper <32876237+johop@users.noreply.github.com>
Date: Fri, 1 Mar 2019 04:22:36 -0600
Subject: [PATCH 25/33] Update how-windows-update-works.md

---
 windows/deployment/update/how-windows-update-works.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/windows/deployment/update/how-windows-update-works.md b/windows/deployment/update/how-windows-update-works.md
index b073e9cd2f..8436f310a4 100644
--- a/windows/deployment/update/how-windows-update-works.md
+++ b/windows/deployment/update/how-windows-update-works.md
@@ -19,7 +19,7 @@ The Windows Update workflow has four core areas of functionality:
 ### Scan
 
 1. Orchestrator schedules the scan.
-2. Orchestrator vertifies admin approvals and policies for download.
+2. Orchestrator verifies admin approvals and policies for download.
 
 
 ### Download
@@ -139,4 +139,4 @@ The action list describes all the files needed from WU, and what the install age
 
 When the option to automatically install updates is configured, the Windows Update Orchestrator, in most cases, automatically restarts the PC for you after installing the updates. This is necessary because your PC may be insecure, or not fully updated, until a restart is completed. You can use Group Policy settings, mobile device management (MDM), or  the registry (not recommended) to configure when devices will restart after a Windows 10 update is installed.  
 
-For more information see [Manage device restarts after updates](waas-restart.md). 
\ No newline at end of file
+For more information see [Manage device restarts after updates](waas-restart.md). 

From c01fc3fd322b23a2115107f2ea4b891805f5aafc Mon Sep 17 00:00:00 2001
From: illfated <illfated@users.noreply.github.com>
Date: Fri, 1 Mar 2019 22:33:10 +0100
Subject: [PATCH 26/33] Security/Threat Protection: insert correct link to
 Windows Defender System Guard

**Suggested changes:**
- Repair the broken link to "Windows Defender System Guard" in the page file
  overview-hardware-based-isolation.md
- Remove 3 redundant blank lines at the end of the page.

Thanks to @Sherd21 for finding and providing the correct link.

Closes #2813
---
 .../overview-hardware-based-isolation.md                     | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/windows/security/threat-protection/windows-defender-atp/overview-hardware-based-isolation.md b/windows/security/threat-protection/windows-defender-atp/overview-hardware-based-isolation.md
index f98065e413..ed95fc2a62 100644
--- a/windows/security/threat-protection/windows-defender-atp/overview-hardware-based-isolation.md
+++ b/windows/security/threat-protection/windows-defender-atp/overview-hardware-based-isolation.md
@@ -25,8 +25,5 @@ Hardware-based isolation helps protect system integrity in Windows 10 and is int
 | Feature | Description |
 |------------|-------------|
 | [Windows Defender Application Guard](../windows-defender-application-guard/wd-app-guard-overview.md) | Application Guard protects your device from advanced attacks while keeping you productive. Using a unique hardware-based isolation approach, the goal is to isolate untrusted websites and PDF documents inside a lightweight container that is separated from the operating system via the native Windows Hypervisor. If an untrusted site or PDF document turns out to be malicious, it still remains contained within Application Guard’s secure container, keeping the desktop PC protected and the attacker away from your enterprise data. |
-| [Windows Defender System Guard](how-hardware-based-containers-help-protect-windows.md) | System Guard protects and maintains the integrity of the system as it starts and after it's running, and validates system integrity by using attestation.  |
-
-
-
+| [Windows Defender System Guard](../windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows.md) | System Guard protects and maintains the integrity of the system as it starts and after it's running, and validates system integrity by using attestation.  |
 

From 6eaa470237ac3c2d373da9263bfad9356a9e3613 Mon Sep 17 00:00:00 2001
From: illfated <illfated@users.noreply.github.com>
Date: Fri, 1 Mar 2019 23:31:57 +0100
Subject: [PATCH 27/33] Windows Defender System Guard: New file name in link

As per information received in conversation with @Justinha in issue #2813 , the new file name is
system-guard-how-hardware-based-root-of-trust-helps-protect-windows.md

(previously: how-hardware-based-root-of-trust-helps-protect-windows.md)
---
 .../windows-defender-atp/overview-hardware-based-isolation.md   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/windows/security/threat-protection/windows-defender-atp/overview-hardware-based-isolation.md b/windows/security/threat-protection/windows-defender-atp/overview-hardware-based-isolation.md
index ed95fc2a62..6bf35eb789 100644
--- a/windows/security/threat-protection/windows-defender-atp/overview-hardware-based-isolation.md
+++ b/windows/security/threat-protection/windows-defender-atp/overview-hardware-based-isolation.md
@@ -25,5 +25,5 @@ Hardware-based isolation helps protect system integrity in Windows 10 and is int
 | Feature | Description |
 |------------|-------------|
 | [Windows Defender Application Guard](../windows-defender-application-guard/wd-app-guard-overview.md) | Application Guard protects your device from advanced attacks while keeping you productive. Using a unique hardware-based isolation approach, the goal is to isolate untrusted websites and PDF documents inside a lightweight container that is separated from the operating system via the native Windows Hypervisor. If an untrusted site or PDF document turns out to be malicious, it still remains contained within Application Guard’s secure container, keeping the desktop PC protected and the attacker away from your enterprise data. |
-| [Windows Defender System Guard](../windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows.md) | System Guard protects and maintains the integrity of the system as it starts and after it's running, and validates system integrity by using attestation.  |
+| [Windows Defender System Guard](../windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows.md) | System Guard protects and maintains the integrity of the system as it starts and after it's running, and validates system integrity by using attestation.  |
 

From 8efff605854aed0e5b7e7532b29e88fb9b5e7f83 Mon Sep 17 00:00:00 2001
From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com>
Date: Sat, 2 Mar 2019 16:28:51 +0500
Subject: [PATCH 28/33] Update vpnv2-csp.md, issue #2788
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Explanation added. Source:
1. [VPN tunnel strategy – defining the connection order between various tunnel types](https://blogs.technet.microsoft.com/rrasblog/2009/02/11/vpn-tunnel-strategy-defining-the-connection-order-between-various-tunnel-types/)
2. [RRAS/VPN - Automatic tunnel type connection order] (https://social.technet.microsoft.com/Forums/windowsserver/05749d5d-3381-4c46-99fe-dc7b7c361e1c/rrasvpn-automatic-tunnel-type-connection-order?forum=win10itpronetworking)
3. [VPN connection types] (https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-connection-type)
---
 windows/client-management/mdm/vpnv2-csp.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/windows/client-management/mdm/vpnv2-csp.md b/windows/client-management/mdm/vpnv2-csp.md
index fe6bdbb4ad..4142e8244f 100644
--- a/windows/client-management/mdm/vpnv2-csp.md
+++ b/windows/client-management/mdm/vpnv2-csp.md
@@ -448,6 +448,8 @@ Required for native profiles. Type of tunneling protocol used. This value can be
 
 Value type is chr. Supported operations include Get, Add, Replace, and Delete.
 
+> **Note** The **Automatic** option means that the device will try each of the built-in tunneling protocols until one succeeds. It will attempt protocols in following order: IKEv2, PPTP and then L2TP. This order is not customizable. 
+
 <a href="" id="vpnv2-profilename-nativeprofile-authentication"></a>**VPNv2/***ProfileName***/NativeProfile/Authentication**  
 Required node for native profile. It contains authentication information for the native VPN profile.
 

From 0c3ce13bad580497d3d02f726375ca71585fe15e Mon Sep 17 00:00:00 2001
From: Ronald den Os <41728016+Ronald-den-Os@users.noreply.github.com>
Date: Mon, 4 Mar 2019 10:09:14 +0100
Subject: [PATCH 29/33] Consistency

Changed "Phonefactors Admin" group to "Phonefactor Admins" groups twice
---
 .../hello-for-business/hello-cert-trust-deploy-mfa.md         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-deploy-mfa.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-deploy-mfa.md
index a763b76800..e6b69e32b2 100644
--- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-deploy-mfa.md
+++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-deploy-mfa.md
@@ -108,7 +108,7 @@ Sign in the domain controller with _domain administrator_ equivalent credentials
 ##### Add accounts to the Phonefactor Admins group
 
 1. Open **Active Directory Users and Computers**.
-2. In the navigation pane, expand the node with the organization’s Active Directory domain name.  Select Users. In the content pane. Right-click the **Phonefactors Admin** security group and select **Properties**.
+2. In the navigation pane, expand the node with the organization’s Active Directory domain name.  Select Users. In the content pane. Right-click the **Phonefactor Admins** security group and select **Properties**.
 3. Click the **Members** tab.
 4. Click **Add**. Click **Object Types..** In the **Object Types** dialog box, select **Computers** and click **OK**. Enter the following user and/or computers accounts in the **Enter the object names to select** box and then click **OK**.   
     * The computer account for the primary MFA Server
@@ -189,7 +189,7 @@ The User Portal and Mobile Application web services need to communicate with the
 Adding the WebServices SDK user account to the Phonefactor Admins group provides the user account with the proper authorization needed to access the configuration data on the primary MFA server using the WebServices SDK.
 
 1. Open **Active Directory Users and Computers**.
-2. In the navigation pane, expand the node with the organization’s Active Directory domain name.  Select **Users**. In the content pane. Right-click the **Phonefactors Admin** security group and select Properties.
+2. In the navigation pane, expand the node with the organization’s Active Directory domain name.  Select **Users**. In the content pane. Right-click the **Phonefactor Admins** security group and select Properties.
 3. Click the Members tab.
 4. Click **Add**. Click **Object Types..** Type the PFWSDK_<computerName> user name in the **Enter the object names to select** box and then click **OK**.   
     * The computer account for the primary MFA Server

From 9d561a7428bf376d6e3b8e3471dc1ab3459ff920 Mon Sep 17 00:00:00 2001
From: Jeanie Decker <jdecker@microsoft.com>
Date: Mon, 4 Mar 2019 06:06:14 -0800
Subject: [PATCH 30/33] fix typo

---
 devices/surface/battery-limit.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/devices/surface/battery-limit.md b/devices/surface/battery-limit.md
index cd61a7ad8d..b1a34e4f19 100644
--- a/devices/surface/battery-limit.md
+++ b/devices/surface/battery-limit.md
@@ -19,7 +19,7 @@ Battery Limit option is a UEFI setting that changes how the Surface device batte
 
 Setting the device on Battery Limit changes the protocol for charging the device battery. When Battery Limit is enabled, the battery charge will be limited to 50% of its maximum capacity. The charge level reported in Windows will reflect this limit. Therefore, it will show that the battery is charged up to 50% and will not charge beyond  this limit. If you enable Battery Limit while the device is above 50% charge, the Battery icon will show that the device is plugged in but discharging until the device reaches 50% of its maximum charge capacity.  
 
-Adding the Battery Limit option to Surface UEFI requires a [Surface UEFI firmware update](update.md), available through Windows Update or via the MSI driver and firmware packages on the Microsoft Download Center. Check [Enable "Battery Limit" for Surface devices that have to be plugged in for extended periods of time](https://support.microsoft.com/help/4464941) for the specific Surface UEFI version required for each supported device . Currently, Battery Limit is supported on a subset of Surface devices and will be available in the future on other Surface device models. 
+Adding the Battery Limit option to Surface UEFI requires a [Surface UEFI firmware update](update.md), available through Windows Update or via the MSI driver and firmware packages on the Microsoft Download Center. Check [Enable "Battery Limit" for Surface devices that have to be plugged in for extended periods of time](https://support.microsoft.com/help/4464941) for the specific Surface UEFI version required for each supported device. Currently, Battery Limit is supported on a subset of Surface devices and will be available in the future on other Surface device models. 
 
 ## Enabling Battery Limit in Surface UEFI (Surface Pro 4 and later)
 

From 7391641da1e2a24ab58589638a06f966268bc700 Mon Sep 17 00:00:00 2001
From: Jeanie Decker <jdecker@microsoft.com>
Date: Mon, 4 Mar 2019 06:12:59 -0800
Subject: [PATCH 31/33] cleaned up url in new link

---
 devices/surface-hub/prepare-your-environment-for-surface-hub.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/devices/surface-hub/prepare-your-environment-for-surface-hub.md b/devices/surface-hub/prepare-your-environment-for-surface-hub.md
index 98d3cd4e4f..6f1deba6b9 100644
--- a/devices/surface-hub/prepare-your-environment-for-surface-hub.md
+++ b/devices/surface-hub/prepare-your-environment-for-surface-hub.md
@@ -37,7 +37,7 @@ Additionally, note that Surface Hub requires the following open ports:
 
 If you are using Surface Hub with Skype for Business, you will need to open additional ports. Please follow the guidance below:
 - If you use Skype for Business Online, see [Office 365 IP URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US).
-- If you use Skype for Business Server, see [Skype for Business Server: Ports and protocols for internal servers](https://docs.microsoft.com/SkypeForBusiness/plan-your-deployment/network-requirements/ports-and-protocols?toc=/SkypeForBusiness/toc.json&bc=/SkypeForBusiness/breadcrumb/toc.json). 
+- If you use Skype for Business Server, see [Skype for Business Server: Ports and protocols for internal servers](https://docs.microsoft.com/SkypeForBusiness/plan-your-deployment/network-requirements/ports-and-protocols). 
 - If you use a hybrid of Skype for Business Online and Skype for Business Server, you need to open all documented ports from [Office 365 IP URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US) and [Skype for Business Server: Ports and protocols for internal servers](https://docs.microsoft.com/SkypeForBusiness/plan-your-deployment/network-requirements/ports-and-protocols?toc=/SkypeForBusiness/toc.json&bc=/SkypeForBusiness/breadcrumb/toc.json).
 
 Microsoft collects diagnostic data to help improve your Surface Hub experience. Add these sites to your allow list:

From 840a5fa4db1b5594913f1372483681ba3962d968 Mon Sep 17 00:00:00 2001
From: Trudy Hakala <trudyha@microsoft.com>
Date: Mon, 4 Mar 2019 17:19:42 +0000
Subject: [PATCH 32/33] Merged PR 14615: update links

change staging links to live links
---
 store-for-business/billing-understand-your-invoice-msfb.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/store-for-business/billing-understand-your-invoice-msfb.md b/store-for-business/billing-understand-your-invoice-msfb.md
index 7e59e62d5a..baa42e23a6 100644
--- a/store-for-business/billing-understand-your-invoice-msfb.md
+++ b/store-for-business/billing-understand-your-invoice-msfb.md
@@ -80,7 +80,7 @@ You'll see the charges, tax, and the total amount due. Azure customers will also
 
 `Total = Charges - Azure Credit + Tax`
 
-The details show the cost broken down by product order name. For Azure customers, this might be organized by invoice section. For more information about how invoice sections are used with Azure products, see [Understand invoice sections](https://review.docs.microsoft.com/azure/billing/billing-mca-overview?branch=release-modern-billing#understand-invoice-sections). 
+The details show the cost broken down by product order name. For Azure customers, this might be organized by invoice section. For more information about how invoice sections are used with Azure products, see [Understand invoice sections](https://docs.microsoft.com/azure/billing/billing-mca-overview#understand-invoice-sections). 
 Within each product order, cost is broken down by service family.
 
 The total amount due for each service family is calculated by subtracting Azure credits from credits/charges and adding tax:
@@ -109,10 +109,10 @@ If you have third-party services in your bill, the name and address of each publ
 If prices were converted to your local currency, the exchange rates are listed in this section at the bottom of the invoice. All Azure charges are priced in USD and third-party services are priced in the seller's currency.
 
 ## Next steps
-If there are Azure charges on your invoice that you would like more details on, see [Understand the Azure charges on your Microsoft Customer Agreement invoice](https://review.docs.microsoft.com/en-us/azure/billing/billing-understand-your-invoice-mca?branch=release-modern-billing).
+If there are Azure charges on your invoice that you would like more details on, see [Understand the Azure charges on your Microsoft Customer Agreement invoice](https://docs.microsoft.com/en-us/azure/billing/billing-understand-your-invoice-mca).
 
 ## Need help? Contact us.
 
 If you have questions or need help with your Azure charges, [create a support request with Azure support](https://portal.azure.com/#blade/Microsoft_Azure_Support/HelpAndSupportBlade/newsupportrequest).
 
-If you have questions or need help with your invoice in Microsoft Store for Business, [create a support request with Store for Business support](https://businessstore.microsoft.com).
+If you have questions or need help with your invoice in Microsoft Store for Business, [create a support request with Store for Business support](https://businessstore.microsoft.com/manage/support/summary).

From d88c26d4c703b6cabc0d730be77e12fcc05a41f7 Mon Sep 17 00:00:00 2001
From: Jeanie Decker <jdecker@microsoft.com>
Date: Mon, 4 Mar 2019 09:44:48 -0800
Subject: [PATCH 33/33] kick

---
 windows/configuration/kiosk-prepare.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/windows/configuration/kiosk-prepare.md b/windows/configuration/kiosk-prepare.md
index 515e4fa81f..81e49742b0 100644
--- a/windows/configuration/kiosk-prepare.md
+++ b/windows/configuration/kiosk-prepare.md
@@ -44,6 +44,7 @@ Disable the camera. |     Go to **Settings** &gt; **Privacy** &gt; **Camera**, a
 Turn off app notifications on the lock screen. |     Go to **Group Policy Editor** &gt; **Computer Configuration** &gt; **Administrative Templates\\System\\Logon\\Turn off app notifications on the lock screen**.
 Disable removable media. |     Go to **Group Policy Editor** &gt; **Computer Configuration** &gt; **Administrative Templates\\System\\Device Installation\\Device Installation Restrictions**. Review the policy settings available in **Device Installation Restrictions** for the settings applicable to your situation.</br></br>**NOTE**: To prevent this policy from affecting a member of the Administrators group, in **Device Installation Restrictions**, enable **Allow administrators to override Device Installation Restriction policies**.
 
+
 ## Enable logging
 
 Logs can help you [troubleshoot issues](multi-app-kiosk-troubleshoot.md) kiosk issues. Logs about configuration and runtime issues can be obtained by enabling the **Applications and Services Logs\Microsoft\Windows\AssignedAccess\Operational** channel, which is disabled by default.