Merge branch 'main' of github.com:MicrosoftDocs/windows-docs-pr into pm-20250225-kiosk

This commit is contained in:
Paolo Matarazzo
2025-02-26 16:50:47 -05:00
41 changed files with 117 additions and 206 deletions

View File

@ -1,14 +1,16 @@
---
title: WEDL\_AssignedAccess
description: WEDL\_AssignedAccess
ms.date: 05/20/2024
title: WEDL_AssignedAccess
description: WEDL_AssignedAccess
ms.date: 02/25/2025
ms.topic: reference
---
# WEDL\_AssignedAccess
# WEDL_AssignedAccess
This Windows Management Instrumentation (WMI) provider class configures settings for assigned access.
[!INCLUDE [shell-launcher](../../../includes/licensing/assigned-access.md)]
## Syntax
```powershell
@ -129,13 +131,3 @@ if ($AssignedAccessConfig) {
"Could not set up assigned access account."
}
```
## Requirements
| Windows Edition | Supported |
|:-----------------------|:---------:|
| Windows Home | No |
| Windows Pro | No |
| Windows Enterprise | Yes |
| Windows Education | Yes |
| Windows IoT Enterprise | Yes |

View File

@ -1,7 +1,7 @@
---
title: WESL_UserSetting
description: WESL_UserSetting
ms.date: 05/02/2017
ms.date: 02/25/2025
ms.topic: reference
---
@ -9,6 +9,8 @@ ms.topic: reference
This class configures which application Shell Launcher starts based on the security identifier (SID) of the signed in user, and also configures the set of return codes and return actions that Shell Launcher performs when the application exits.
[!INCLUDE [shell-launcher](../../../includes/licensing/shell-launcher.md)]
## Syntax
```powershell
@ -158,17 +160,3 @@ $ShellLauncherClass.RemoveCustomShell($Admins_SID)
$ShellLauncherClass.RemoveCustomShell($Cashier_SID)
```
## Requirements
| Windows Edition | Supported |
|:-----------------------|:---------:|
| Windows Home | No |
| Windows Pro | No |
| Windows Enterprise | Yes |
| Windows Education | Yes |
| Windows IoT Enterprise | Yes |
## Related topics
- [Shell Launcher](index.md)

View File

@ -1,7 +1,7 @@
---
title: WESL_UserSetting.GetCustomShell
description: WESL_UserSetting.GetCustomShell
ms.date: 05/20/2024
ms.date: 02/25/2025
ms.topic: reference
---
@ -9,6 +9,8 @@ ms.topic: reference
This method retrieves the Shell Launcher configuration for a specific user or group, based on the security identifier (SID).
[!INCLUDE [shell-launcher](../../../includes/licensing/shell-launcher.md)]
## Syntax
```powershell
@ -60,18 +62,3 @@ Returns an HRESULT value that indicates [WMI status](/windows/win32/wmisdk/wmi-n
Shell Launcher uses the *CustomReturnCodes* and *CustomReturnCodesAction* arrays to determine the system behavior when the shell application exits, based on the return value of the application.
If the return value does not exist in *CustomReturnCodes*, or if the corresponding action defined in *CustomReturnCodesAction* is not a valid value, Shell Launcher uses *DefaultAction* to determine system behavior. If *DefaultAction* is not defined, or is not a valid value, Shell Launcher restarts the shell application.
## Requirements
| Windows Edition | Supported |
|:-----------------------|:---------:|
| Windows Home | No |
| Windows Pro | No |
| Windows Enterprise | Yes |
| Windows Education | Yes |
| Windows IoT Enterprise | Yes |
## Related topics
- [WESL_UserSetting](wesl-usersetting.md)
- [Shell Launcher](index.md)

View File

@ -1,7 +1,7 @@
---
title: WESL_UserSetting.GetDefaultShell
description: WESL_UserSetting.GetDefaultShell
ms.date: 05/20/2024
ms.date: 02/25/2025
ms.topic: reference
---
@ -9,6 +9,8 @@ ms.topic: reference
This method retrieves the default Shell Launcher configuration.
[!INCLUDE [shell-launcher](../../../includes/licensing/shell-launcher.md)]
## Syntax
```powershell
@ -40,18 +42,3 @@ Returns an HRESULT value that indicates [WMI status](/windows/win32/wmisdk/wmi-n
## Remarks
Shell Launcher uses the default configuration when the security identifier (SID) of the user who is currently signed in does not match any custom defined Shell Launcher configurations.
## Requirements
| Windows Edition | Supported |
|:-----------------------|:---------:|
| Windows Home | No |
| Windows Pro | No |
| Windows Enterprise | Yes |
| Windows Education | Yes |
| Windows IoT Enterprise | Yes |
## Related topics
- [WESL_UserSetting](wesl-usersetting.md)
- [Shell Launcher](index.md)

View File

@ -1,7 +1,7 @@
---
title: WESL_UserSetting.IsEnabled
description: WESL_UserSetting.IsEnabled
ms.date: 05/20/2024
ms.date: 02/25/2025
ms.topic: reference
---
@ -9,6 +9,8 @@ ms.topic: reference
This method retrieves a value that indicates if Shell Launcher is enabled or disabled.
[!INCLUDE [shell-launcher](../../../includes/licensing/shell-launcher.md)]
## Syntax
```powershell
@ -24,18 +26,3 @@ This method retrieves a value that indicates if Shell Launcher is enabled or dis
## Return Value
Returns an HRESULT value that indicates [WMI status](/windows/win32/wmisdk/wmi-non-error-constants) or a [WMI error](/windows/win32/wmisdk/wmi-error-constants).
## Requirements
| Windows Edition | Supported |
|:-----------------------|:---------:|
| Windows Home | No |
| Windows Pro | No |
| Windows Enterprise | Yes |
| Windows Education | Yes |
| Windows IoT Enterprise | Yes |
## Related topics
- [WESL_UserSetting](wesl-usersetting.md)
- [Shell Launcher](index.md)

View File

@ -1,7 +1,7 @@
---
title: WESL_UserSetting.RemoveCustomShell
description: WESL_UserSetting.RemoveCustomShell
ms.date: 05/20/2024
ms.date: 02/25/2025
ms.topic: reference
---
@ -9,6 +9,8 @@ ms.topic: reference
This method removes a Shell Launcher configuration for a specific user or group, based on the security identifier (SID).
[!INCLUDE [shell-launcher](../../../includes/licensing/shell-launcher.md)]
## Syntax
```powershell
@ -28,18 +30,3 @@ Returns an HRESULT value that indicates [WMI status](/windows/win32/wmisdk/wmi-n
## Remarks
You must restart your device for the changes to take effect.
## Requirements
| Windows Edition | Supported |
|:-----------------------|:---------:|
| Windows Home | No |
| Windows Pro | No |
| Windows Enterprise | Yes |
| Windows Education | Yes |
| Windows IoT Enterprise | Yes |
## Related topics
- [WESL_UserSetting](wesl-usersetting.md)
- [Shell Launcher](index.md)

View File

@ -1,7 +1,7 @@
---
title: WESL_UserSetting.SetCustomShell
description: WESL_UserSetting.SetCustomShell
ms.date: 05/20/2024
ms.date: 02/25/2025
ms.topic: reference
---
@ -9,6 +9,8 @@ ms.topic: reference
This method configures Shell Launcher for a specific user or group, based on the security identifier (SID).
[!INCLUDE [shell-launcher](../../../includes/licensing/shell-launcher.md)]
## Syntax
```powershell
@ -60,18 +62,3 @@ Returns an HRESULT value that indicates [WMI status](/windows/win32/wmisdk/wmi-n
Shell Launcher uses the *CustomReturnCodes* and *CustomReturnCodesAction* arrays to determine the system behavior when the shell application exits, based on the return value of the shell application.
If the return value does not exist in *CustomReturnCodes*, or if the corresponding action defined in *CustomReturnCodesAction* is not a valid value, Shell Launcher uses *DefaultAction* to determine system behavior. If *DefaultAction* is not defined, or is not a valid value, Shell Launcher restarts the shell application.
## Requirements
| Windows Edition | Supported |
|:-----------------------|:---------:|
| Windows Home | No |
| Windows Pro | No |
| Windows Enterprise | Yes |
| Windows Education | Yes |
| Windows IoT Enterprise | Yes |
## Related topics
- [WESL_UserSetting](wesl-usersetting.md)
- [Shell Launcher](index.md)

View File

@ -1,7 +1,7 @@
---
title: WESL_UserSetting.SetDefaultShell
description: WESL_UserSetting.SetDefaultShell
ms.date: 05/20/2024
ms.date: 02/25/2025
ms.topic: reference
---
@ -9,6 +9,8 @@ ms.topic: reference
This method sets the default Shell Launcher configuration.
[!INCLUDE [shell-launcher](../../../includes/licensing/shell-launcher.md)]
## Syntax
```powershell
@ -40,18 +42,3 @@ Returns an HRESULT value that indicates [WMI status](/windows/win32/wmisdk/wmi-n
## Remarks
Shell Launcher uses the default configuration when the security identifier (SID) of the user who is currently signed in does not match any custom defined Shell Launcher configurations.
## Requirements
| Windows Edition | Supported |
|:-----------------------|:---------:|
| Windows Home | No |
| Windows Pro | No |
| Windows Enterprise | Yes |
| Windows Education | Yes |
| Windows IoT Enterprise | Yes |
## Related topics
- [WESL_UserSetting](wesl-usersetting.md)
- [Shell Launcher](index.md)

View File

@ -1,7 +1,7 @@
---
title: WESL_UserSetting.SetEnabled
description: WESL_UserSetting.SetEnabled
ms.date: 05/20/2024
ms.date: 02/25/2025
ms.topic: reference
---
@ -9,6 +9,8 @@ ms.topic: reference
This method enables or disables Shell Launcher.
[!INCLUDE [shell-launcher](../../../includes/licensing/shell-launcher.md)]
## Syntax
```powershell
@ -30,18 +32,3 @@ Returns an HRESULT value that indicates [WMI status](/windows/win32/wmisdk/wmi-n
This method enables or disables Shell Launcher by modifying the **Shell** value in the registry key `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon`. If Unified Write Filter (UWF) is enabled, you may need to disable UWF or commit this registry key by using [UWF_RegistryFilter.CommitRegistry](../unified-write-filter/uwf-registryfiltercommitregistry.md) in order to enable or disable Shell Launcher.
Enabling or disabling Shell Launcher does not take effect until a user signs in.
## Requirements
| Windows Edition | Supported |
|:-----------------------|:---------:|
| Windows Home | No |
| Windows Pro | No |
| Windows Enterprise | Yes |
| Windows Education | Yes |
| Windows IoT Enterprise | Yes |
## Related topics
- [WESL_UserSetting](wesl-usersetting.md)
- [Shell Launcher](index.md)

View File

@ -1,7 +1,7 @@
---
author: paolomatarazzo
ms.author: paoloma
ms.date: 04/10/2024
ms.date: 02/25/2025
ms.topic: include
---
@ -9,14 +9,8 @@ ms.topic: include
With this policy setting, you can prevent the Start menu from displaying a list of recently installed applications:
- If **enabled**, the Start menu doesn't display the **Recently added** list. The corresponding option in Settings can't be configured (grayed out).
- If **disabled** or **not configured**, the Start menu displays the **Recently added** list. The corresponding option in Settings can be configured.
> [!IMPORTANT]
> Starting in Windows 11, version 22H2 with [KB5048685](https://support.microsoft.com/topic/4602-ea3736d3-6948-4fd7-9faf-8d732ac2ed59), the policy setting behavior changed.
>
> - If **enabled**, the corresponding option in Settings can't be configured (grayed out). The policy setting doesn't affect the display of recently installed applications in the Recommended section of the Start menu.
> - If **disabled** or **not configured**, the corresponding option in Settings can be configured.
- If **enabled**, the Start menu doesn't display the **Recently added** list. The corresponding option in Settings can't be configured (grayed out)
- If **disabled** or **not configured**, the Start menu displays the **Recently added** list. The corresponding option in Settings can be configured
| | Path |
|--|--|

View File

@ -2,7 +2,7 @@
title: Start policy settings
description: Learn about the policy settings to configure the Windows Start menu.
ms.topic: reference
ms.date: 07/10/2024
ms.date: 02/25/2025
appliesto:
zone_pivot_groups: windows-versions-11-10
---

View File

@ -0,0 +1,23 @@
---
author: paolomatarazzo
ms.author: paoloma
ms.date: 02/25/2025
ms.topic: include
---
### Show notification bell icon
This policy setting allows you to show the notification bell icon in the system tray:
- If you enable this policy setting, the notification icon is always displayed
- If you disable or don't configure this policy setting, the notification icon is only displayed when there's a special status (for example, when *do not disturb* is turned on)
> [!NOTE]
> A reboot is required for this policy setting to take effect.
| | Path |
|--|--|
| **CSP** |- `./User/Vendor/MSFT/Policy/Config/Start/`[AlwaysShowNotificationIcon](/windows/client-management/mdm/policy-csp-start#AlwaysShowNotificationIcon) |
| **GPO** |- **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** |
<!-- not linked yet as it's in Insider>

View File

@ -0,0 +1,22 @@
---
author: paolomatarazzo
ms.author: paoloma
ms.date: 02/25/2025
ms.topic: include
---
### Turn off abbreviated time and date format
This policy setting allows you to show the longer time and date format in the system tray:
- If you enable this policy setting, the time format will include the AM/PM time marker and the date will include the year.
> [!NOTE]
> A reboot is required for this policy setting to take effect.
| | Path |
|--|--|
| **CSP** |- `./User/Vendor/MSFT/Policy/Config/Start/`[TurnOffAbbreviatedDateTimeFormat](/windows/client-management/mdm/policy-csp-start#TurnOffAbbreviatedDateTimeFormat) |
| **GPO** |- **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** |
<!-- not linked yet as it's in Insider>

View File

@ -174,15 +174,18 @@ You can add the *Device configurations* permission with one or more rights to yo
### [Windows Enterprise E3+ and F3](#tab/windows-enterprise-e3-f3-intune-permissions)
Your account must be assigned an [Intune role-based access control](/mem/intune/fundamentals/role-based-access-control) (RBAC) role that includes the following permissions:
- **Device configurations**:
- Assign
- Create
- Delete
- View Reports
- Update
- Read
After you [activate Windows Autopatch features](../prepare/windows-autopatch-feature-activation.md#activate-windows-autopatch-features), use the Intune Service Administrator role to register devices, manage your update deployments, and reporting tasks.
If you want to assign less-privileged user accounts to perform specific tasks in the Windows Autopatch portal, such as register devices with the service, you can add these user accounts into one of the two Microsoft Entra groups created during the [Start using Windows Autopatch](../prepare/windows-autopatch-feature-activation.md) process:
| Microsoft Entra group name | Discover devices | Modify columns | Refresh device list | Export to .CSV | Device actions |
| --- | --- | --- | --- | --- | --- |
| Modern Workplace Roles - Service Administrator | Yes | Yes | Yes | Yes | Yes |
| Modern Workplace Roles - Service Reader | No | Yes | Yes | Yes | Yes |
For more information, see [Microsoft Entra built-in roles](/entra/identity/role-based-access-control/permissions-reference) and [Role-based access control (RBAC) with Microsoft Intune](/mem/intune/fundamentals/role-based-access-control).
> [!TIP]

View File

@ -21,7 +21,7 @@ You can use the App Control for Business Wizard and the PowerShell commands to c
:::image type="content" alt-text="Configuring the policy base and template." source="../images/appid-appcontrol-wizard-1.png" lightbox="../images/appid-appcontrol-wizard-1.png":::
> [!NOTE]
> If your AppId Tagging Policy does build off the base templates or does not allow Windows in-box processes, you will notice significant performance regressions, especially during boot. For this reason, it is strongly recommended to build off the base templates. For more information on the issue, see the [AppId Tagging Known Issue](../operations/known-issues.md#slow-boot-and-performance-with-custom-policies).
> If your AppId Tagging Policy does not build off the base templates or does not allow Windows in-box processes, you will notice significant performance regressions, especially during boot. For this reason, it is strongly recommended to build off the base templates. For more information on the issue, see the [AppId Tagging Known Issue](../operations/known-issues.md#slow-boot-and-performance-with-custom-policies).
2. Set the following rule-options using the Wizard toggles:

View File

@ -1,5 +1,5 @@
---
ms.date: 06/20/2024
ms.date: 02/25/2025
title: Additional mitigations
description: Learn how to improve the security of your domain environment with additional mitigations for Credential Guard and sample code.
ms.topic: reference

View File

@ -1,5 +1,5 @@
---
ms.date: 06/20/2024
ms.date: 02/25/2025
title: Configure Credential Guard
description: Learn how to configure Credential Guard using MDM, Group Policy, or the registry.
ms.topic: how-to

View File

@ -1,5 +1,5 @@
---
ms.date: 06/20/2024
ms.date: 02/25/2025
title: Considerations and known issues when using Credential Guard
description: Considerations, recommendations, and known issues when using Credential Guard.
ms.topic: troubleshooting

View File

@ -1,5 +1,5 @@
---
ms.date: 06/20/2024
ms.date: 02/25/2025
title: How Credential Guard works
description: Learn how Credential Guard uses virtualization to protect secrets, so that only privileged system software can access them.
ms.topic: concept-article

View File

@ -1,5 +1,5 @@
---
ms.date: 06/20/2024
ms.date: 02/25/2025
title: Credential Guard overview
description: Learn about Credential Guard and how it isolates secrets so that only privileged system software can access them.
ms.topic: overview

View File

@ -1,7 +1,7 @@
---
title: Windows Hello for Business cloud-only deployment guide
description: Learn how to deploy Windows Hello for Business in a cloud-only deployment scenario.
ms.date: 11/22/2024
ms.date: 02/25/2025
ms.topic: tutorial
---

View File

@ -1,7 +1,7 @@
---
title: Configure Active Directory Federation Services in a hybrid certificate trust model
description: Learn how to configure Active Directory Federation Services (AD FS) to support the Windows Hello for Business hybrid certificate trust model.
ms.date: 06/23/2024
ms.date: 02/25/2025
ms.topic: tutorial
---

View File

@ -1,7 +1,7 @@
---
title: Configure and enroll in Windows Hello for Business in hybrid certificate trust model
description: Learn how to configure devices and enroll them in Windows Hello for Business in a hybrid certificate trust scenario.
ms.date: 09/26/2024
ms.date: 02/25/2025
ms.topic: tutorial
---

View File

@ -1,7 +1,7 @@
---
title: Configure and validate the PKI in a hybrid certificate trust model
description: Configure and validate the Public Key Infrastructure when deploying Windows Hello for Business in a hybrid certificate trust model.
ms.date: 06/23/2024
ms.date: 02/25/2025
ms.topic: tutorial
---

View File

@ -1,7 +1,7 @@
---
title: Windows Hello for Business hybrid certificate trust deployment guide
description: Learn how to deploy Windows Hello for Business in a hybrid certificate trust scenario.
ms.date: 06/23/2024
ms.date: 02/25/2025
ms.topic: tutorial
---

View File

@ -1,7 +1,7 @@
---
title: Windows Hello for Business cloud Kerberos trust deployment guide
description: Learn how to deploy Windows Hello for Business in a cloud Kerberos trust scenario.
ms.date: 11/22/2024
ms.date: 02/25/2025
ms.topic: tutorial
---
@ -45,7 +45,7 @@ When Microsoft Entra Kerberos is enabled in an Active Directory domain, an *Azur
- Is only used by Microsoft Entra ID to generate TGTs for the Active Directory domain
> [!NOTE]
> Similar rules and restrictions used for RODCs apply to the AzureADKerberos computer object. For example, users that are direct or indirect members of priviliged built-in security groups won't be able to use cloud Kerberos trust.
> Similar rules and restrictions used for RODCs apply to the AzureADKerberos computer object. For example, users that are direct or indirect members of privileged built-in security groups won't be able to use cloud Kerberos trust.
:::image type="content" source="images/azuread-kerberos-object.png" alt-text="Screenshot of the Active Directory Users and Computers console, showing the computer object representing the Microsoft Entra Kerberos server." lightbox="images/azuread-kerberos-object.png":::

View File

@ -1,7 +1,7 @@
---
title: Configure and enroll in Windows Hello for Business in a hybrid key trust model
description: Learn how to configure devices and enroll them in Windows Hello for Business in a hybrid key trust scenario.
ms.date: 11/22/2024
ms.date: 02/25/2025
ms.topic: tutorial
---

View File

@ -1,7 +1,7 @@
---
title: Windows Hello for Business hybrid key trust deployment guide
description: Learn how to deploy Windows Hello for Business in a hybrid key trust scenario.
ms.date: 11/22/2024
ms.date: 02/25/2025
ms.topic: tutorial
---

View File

@ -1,7 +1,7 @@
---
title: Plan a Windows Hello for Business Deployment
description: Learn about the role of each component within Windows Hello for Business and how certain deployment decisions affect other aspects of your infrastructure.
ms.date: 10/30/2024
ms.date: 02/25/2025
ms.topic: concept-article
---
@ -251,7 +251,7 @@ Here are some considerations regarding licensing requirements for cloud services
### Windows requirements
All supported Windows versions can be used with Windows Hello for Business. However, cloud Kerberos trust requires minimum versions:
All supported Windows (client) versions can be used with Windows Hello for Business. However, cloud Kerberos trust requires minimum versions:
|| Deployment model | Trust type | Windows version|
|--|--|--|--|

View File

@ -1,7 +1,7 @@
---
title: Configure Active Directory Federation Services in an on-premises certificate trust model
description: Learn how to configure Active Directory Federation Services (AD FS) to support the Windows Hello for Business on-premises certificate trust model.
ms.date: 06/23/2024
ms.date: 02/25/2025
ms.topic: tutorial
---

View File

@ -1,5 +1,5 @@
---
ms.date: 06/23/2024
ms.date: 02/25/2025
ms.topic: tutorial
title: Configure Windows Hello for Business Policy settings in an on-premises certificate trust
description: Configure Windows Hello for Business Policy settings for Windows Hello for Business in an on-premises certificate trust scenario

View File

@ -1,7 +1,7 @@
---
title: Windows Hello for Business on-premises certificate trust deployment guide
description: Learn how to deploy Windows Hello for Business in an on-premises, certificate trust scenario.
ms.date: 06/23/2024
ms.date: 02/25/2025
ms.topic: tutorial
---

View File

@ -1,7 +1,7 @@
---
title: Configure Active Directory Federation Services in an on-premises key trust model
description: Learn how to configure Active Directory Federation Services (AD FS) to support the Windows Hello for Business key trust model.
ms.date: 11/22/2024
ms.date: 02/25/2025
ms.topic: tutorial
---

View File

@ -1,5 +1,5 @@
---
ms.date: 06/23/2024
ms.date: 02/25/2025
ms.topic: tutorial
title: Configure Windows Hello for Business Policy settings in an on-premises key trust
description: Configure Windows Hello for Business Policy settings for Windows Hello for Business in an on-premises key trust scenario

View File

@ -1,7 +1,7 @@
---
title: Windows Hello for Business on-premises key trust deployment guide
description: Learn how to deploy Windows Hello for Business in an on-premises, key trust scenario.
ms.date: 06/24/2024
ms.date: 02/25/2025
ms.topic: tutorial
---

View File

@ -1,7 +1,7 @@
---
title: Prepare users to provision and use Windows Hello for Business
description: Learn how to prepare users to enroll and to use Windows Hello for Business.
ms.date: 11/22/2024
ms.date: 02/25/2025
ms.topic: end-user-help
---

View File

@ -2,7 +2,7 @@
title: Configure S/MIME For Windows
description: S/MIME lets users encrypt outgoing messages and attachments so that only intended recipients with a digital ID, also known as a certificate, can read them. Learn how to configure S/MIME for Windows.
ms.topic: how-to
ms.date: 12/02/2024
ms.date: 02/25/2025
---

View File

@ -1,7 +1,7 @@
---
title: Encrypted hard drives
description: Learn how encrypted hard drives use the rapid encryption that is provided by BitLocker to enhance data security and management.
ms.date: 07/22/2024
ms.date: 02/25/2025
ms.topic: concept-article
---